xmrig | d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf

Analysis

max time kernel
63s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Size

1.9MB
MD5

03c318f87a0d38fa5e29f5a91dac807f
SHA1

521655606ec73b87cb0a4ce9b2636c0d1d72f931
SHA256

d1178241d20d0d1fc7035e37b701a20d236aa2792cd9a36959908f6de8ea4fbf
SHA512

ce14c11d82233bff7c9398ba2046cb209fdfcfd3597ec12b7b534a7ea272a7ae1012cff363be9c1726c63d7f3ae848b2cced4777f88da51f1f9c60c4d3096855
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uf:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	xmrig
behavioral2/memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp	xmrig
behavioral2/memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp	xmrig
behavioral2/memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	xmrig
behavioral2/memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	xmrig
behavioral2/memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	xmrig
behavioral2/memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	xmrig
behavioral2/memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	xmrig
behavioral2/memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp	xmrig
behavioral2/memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	xmrig
behavioral2/memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	xmrig
behavioral2/memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp	xmrig
behavioral2/memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp	xmrig
behavioral2/memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	xmrig
behavioral2/memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	xmrig
behavioral2/memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp	xmrig
behavioral2/memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	xmrig
behavioral2/memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	xmrig
behavioral2/memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	xmrig
behavioral2/memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp	xmrig
behavioral2/memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	xmrig
behavioral2/memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	xmrig
behavioral2/memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	xmrig
behavioral2/memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	xmrig
behavioral2/memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	xmrig
behavioral2/memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp	xmrig
behavioral2/memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	xmrig
behavioral2/memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp	xmrig
behavioral2/memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	xmrig
behavioral2/memory/2972-2450-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	xmrig
behavioral2/memory/1268-2448-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	xmrig
behavioral2/memory/3560-2444-0x00007FF701C30000-0x00007FF702022000-memory.dmp	xmrig
behavioral2/memory/3068-2439-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	xmrig
behavioral2/memory/3664-2436-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	xmrig
behavioral2/memory/4048-2441-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	xmrig
behavioral2/memory/2268-2465-0x00007FF708090000-0x00007FF708482000-memory.dmp	xmrig
behavioral2/memory/4300-2470-0x00007FF761C70000-0x00007FF762062000-memory.dmp	xmrig
behavioral2/memory/3424-2473-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	xmrig
behavioral2/memory/4516-2469-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	xmrig
behavioral2/memory/3564-2462-0x00007FF723D50000-0x00007FF724142000-memory.dmp	xmrig
behavioral2/memory/1576-2472-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	xmrig
behavioral2/memory/1220-2460-0x00007FF762320000-0x00007FF762712000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

PHzWtGZ.exeWdmYsCJ.exeVdTLFnl.exeixKnPdR.exexSubBrr.exeTiexlvh.exeiyrGRee.exeiLtWcAs.exeKKoAfPw.exesFnbeRF.exelSReJmJ.exenliYJCC.exeBLjkpgj.exeanMJFkE.exeBKTSbxC.exeVCFKiPH.exeWuwiegC.exeFRLvPWF.exejEJXgNg.exeielurPd.exeYyNOLXU.exeajazpdD.exeQvBHgcJ.exeHlAZIBO.exeUtGyPQj.exeaXVduOR.exeDdIBLuI.exenmbPpuW.exeonevXfS.exewsGDcbN.exefulODJi.exeXnhbrWW.exenLQXojG.exexVPqpjl.exesiKWGMH.exeBMOtGzB.exeamLkRIl.exeqNHlgDC.exeEwQZJCd.exekIaniBl.exeZPuhGCQ.exefHPoHlx.exedYvtyox.exeMsuVtiR.exedSjnMLc.exeKjTCKRp.exedHfoSpC.exeqUmLncM.exeQGVwqTb.exeViMegpl.exeCMKljQa.exeiCdQGRB.exePIrhwHX.exekOlSIbr.exebuQBjKa.exeRzoExBT.exeuUgcsDr.exeHBSGzgg.exeImXIHiN.exerfCkhuM.exeFARscMv.exepALXsXp.exeWXgzLGe.exeKmPSIsY.exe

pid	process
4964	PHzWtGZ.exe
1404	WdmYsCJ.exe
3512	VdTLFnl.exe
3664	ixKnPdR.exe
1676	xSubBrr.exe
3128	Tiexlvh.exe
3896	iyrGRee.exe
3560	iLtWcAs.exe
4048	KKoAfPw.exe
3068	sFnbeRF.exe
2972	lSReJmJ.exe
1268	nliYJCC.exe
368	BLjkpgj.exe
3328	anMJFkE.exe
4300	BKTSbxC.exe
4516	VCFKiPH.exe
3424	WuwiegC.exe
1576	FRLvPWF.exe
2268	jEJXgNg.exe
3564	ielurPd.exe
1220	YyNOLXU.exe
3832	ajazpdD.exe
3076	QvBHgcJ.exe
4848	HlAZIBO.exe
4372	UtGyPQj.exe
1884	aXVduOR.exe
1868	DdIBLuI.exe
4864	nmbPpuW.exe
2412	onevXfS.exe
2540	wsGDcbN.exe
2264	fulODJi.exe
2696	XnhbrWW.exe
4992	nLQXojG.exe
2820	xVPqpjl.exe
3432	siKWGMH.exe
1444	BMOtGzB.exe
1752	amLkRIl.exe
1228	qNHlgDC.exe
2064	EwQZJCd.exe
3984	kIaniBl.exe
2720	ZPuhGCQ.exe
4524	fHPoHlx.exe
3672	dYvtyox.exe
3544	MsuVtiR.exe
1096	dSjnMLc.exe
1876	KjTCKRp.exe
4828	dHfoSpC.exe
4744	qUmLncM.exe
392	QGVwqTb.exe
4712	ViMegpl.exe
3420	CMKljQa.exe
1104	iCdQGRB.exe
4176	PIrhwHX.exe
2960	kOlSIbr.exe
4160	buQBjKa.exe
4064	RzoExBT.exe
3508	uUgcsDr.exe
2304	HBSGzgg.exe
4840	ImXIHiN.exe
3484	rfCkhuM.exe
3500	FARscMv.exe
820	pALXsXp.exe
3376	WXgzLGe.exe
4580	KmPSIsY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/564-0-0x00007FF600B70000-0x00007FF600F62000-memory.dmp	upx
C:\Windows\System\PHzWtGZ.exe	upx
C:\Windows\System\ixKnPdR.exe	upx
C:\Windows\System\VdTLFnl.exe	upx
behavioral2/memory/4964-14-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
C:\Windows\System\WdmYsCJ.exe	upx
C:\Windows\System\xSubBrr.exe	upx
C:\Windows\System\iyrGRee.exe	upx
C:\Windows\System\sFnbeRF.exe	upx
C:\Windows\System\iLtWcAs.exe	upx
C:\Windows\System\BLjkpgj.exe	upx
C:\Windows\System\BKTSbxC.exe	upx
C:\Windows\System\WuwiegC.exe	upx
C:\Windows\System\jEJXgNg.exe	upx
C:\Windows\System\nmbPpuW.exe	upx
C:\Windows\System\onevXfS.exe	upx
C:\Windows\System\nLQXojG.exe	upx
behavioral2/memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	upx
behavioral2/memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp	upx
behavioral2/memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp	upx
behavioral2/memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp	upx
behavioral2/memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	upx
C:\Windows\System\fulODJi.exe	upx
C:\Windows\System\XnhbrWW.exe	upx
C:\Windows\System\wsGDcbN.exe	upx
C:\Windows\System\DdIBLuI.exe	upx
C:\Windows\System\aXVduOR.exe	upx
C:\Windows\System\UtGyPQj.exe	upx
C:\Windows\System\HlAZIBO.exe	upx
C:\Windows\System\QvBHgcJ.exe	upx
C:\Windows\System\ajazpdD.exe	upx
C:\Windows\System\YyNOLXU.exe	upx
C:\Windows\System\ielurPd.exe	upx
C:\Windows\System\FRLvPWF.exe	upx
C:\Windows\System\VCFKiPH.exe	upx
C:\Windows\System\anMJFkE.exe	upx
C:\Windows\System\nliYJCC.exe	upx
C:\Windows\System\lSReJmJ.exe	upx
behavioral2/memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp	upx
C:\Windows\System\KKoAfPw.exe	upx
C:\Windows\System\Tiexlvh.exe	upx
behavioral2/memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	upx
behavioral2/memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp	upx
behavioral2/memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp	upx
behavioral2/memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp	upx
behavioral2/memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	upx
behavioral2/memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp	upx
behavioral2/memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp	upx
behavioral2/memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp	upx
behavioral2/memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp	upx
behavioral2/memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp	upx
behavioral2/memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	upx
behavioral2/memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp	upx
behavioral2/memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp	upx
behavioral2/memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp	upx
behavioral2/memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
behavioral2/memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp	upx
behavioral2/memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp	upx
behavioral2/memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp	upx
behavioral2/memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp	upx
behavioral2/memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp	upx
behavioral2/memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp	upx
behavioral2/memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp	upx
behavioral2/memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

3 raw.githubusercontent.com

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\rfCkhuM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fUxThBN.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ldKXewF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ueuPeOa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\rgFBvhz.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\UeUrekG.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GDvSoHL.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\Ambspqm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\TrmHglg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\zFMupHi.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MKbwkpC.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gbPlddP.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\JqlNafP.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\mqHsotK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fikeGBw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\SzivTOF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GVpIiRw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\hOgJXTf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\NNLWZYK.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ohMybxM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\lJYHBuZ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QYKdoaz.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fVhKlPv.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\rgrpmIn.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YecQgpS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\YqcGejd.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\yDVFumh.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gfOVinF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ywEeOiw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\UZStofu.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\obRDuko.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\eUTaqHS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\DxqGrSv.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\CchUNty.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\NyIRjLr.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\nnHUlFf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\pMuoszI.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\RBfLIaT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\KVkhCsa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\fPwxPIe.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\cyvKNNr.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\sRGcHoF.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\kIgzALm.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\ECapnpH.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QtwfRFg.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\FuoLasb.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\xshLpaS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\iixHoNM.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\THfiMla.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\QiatAfS.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\joSQTZa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\wEFGwHa.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\XTcsCbX.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GxXQNdc.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\vvtcqzT.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\CujAXDQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\kdCFihw.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\oGINvYB.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\MYUNGiW.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\pxCiuFf.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\hXBFGjQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\gxEilsu.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\GqNJaGQ.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
File created	C:\Windows\System\AnGOsEs.exe	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1596 powershell.exe
1596 powershell.exe
1596 powershell.exe

pid	process
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
Token: SeDebugPrivilege	1596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe

description	pid	process	target process
PID 564 wrote to memory of 1596	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	powershell.exe
PID 564 wrote to memory of 1596	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	powershell.exe
PID 564 wrote to memory of 4964	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	PHzWtGZ.exe
PID 564 wrote to memory of 4964	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	PHzWtGZ.exe
PID 564 wrote to memory of 1404	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	WdmYsCJ.exe
PID 564 wrote to memory of 1404	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	WdmYsCJ.exe
PID 564 wrote to memory of 3664	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ixKnPdR.exe
PID 564 wrote to memory of 3664	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ixKnPdR.exe
PID 564 wrote to memory of 3512	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	VdTLFnl.exe
PID 564 wrote to memory of 3512	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	VdTLFnl.exe
PID 564 wrote to memory of 1676	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	xSubBrr.exe
PID 564 wrote to memory of 1676	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	xSubBrr.exe
PID 564 wrote to memory of 3128	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	Tiexlvh.exe
PID 564 wrote to memory of 3128	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	Tiexlvh.exe
PID 564 wrote to memory of 3896	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iyrGRee.exe
PID 564 wrote to memory of 3896	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iyrGRee.exe
PID 564 wrote to memory of 3560	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iLtWcAs.exe
PID 564 wrote to memory of 3560	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	iLtWcAs.exe
PID 564 wrote to memory of 4048	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	KKoAfPw.exe
PID 564 wrote to memory of 4048	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	KKoAfPw.exe
PID 564 wrote to memory of 3068	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	sFnbeRF.exe
PID 564 wrote to memory of 3068	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	sFnbeRF.exe
PID 564 wrote to memory of 2972	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	lSReJmJ.exe
PID 564 wrote to memory of 2972	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	lSReJmJ.exe
PID 564 wrote to memory of 1268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nliYJCC.exe
PID 564 wrote to memory of 1268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nliYJCC.exe
PID 564 wrote to memory of 368	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BLjkpgj.exe
PID 564 wrote to memory of 368	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BLjkpgj.exe
PID 564 wrote to memory of 3328	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	anMJFkE.exe
PID 564 wrote to memory of 3328	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	anMJFkE.exe
PID 564 wrote to memory of 4300	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BKTSbxC.exe
PID 564 wrote to memory of 4300	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	BKTSbxC.exe
PID 564 wrote to memory of 4516	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	VCFKiPH.exe
PID 564 wrote to memory of 4516	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	VCFKiPH.exe
PID 564 wrote to memory of 3424	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	WuwiegC.exe
PID 564 wrote to memory of 3424	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	WuwiegC.exe
PID 564 wrote to memory of 1576	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	FRLvPWF.exe
PID 564 wrote to memory of 1576	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	FRLvPWF.exe
PID 564 wrote to memory of 2268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	jEJXgNg.exe
PID 564 wrote to memory of 2268	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	jEJXgNg.exe
PID 564 wrote to memory of 3564	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ielurPd.exe
PID 564 wrote to memory of 3564	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ielurPd.exe
PID 564 wrote to memory of 1220	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	YyNOLXU.exe
PID 564 wrote to memory of 1220	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	YyNOLXU.exe
PID 564 wrote to memory of 3832	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ajazpdD.exe
PID 564 wrote to memory of 3832	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	ajazpdD.exe
PID 564 wrote to memory of 3076	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	QvBHgcJ.exe
PID 564 wrote to memory of 3076	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	QvBHgcJ.exe
PID 564 wrote to memory of 4848	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	HlAZIBO.exe
PID 564 wrote to memory of 4848	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	HlAZIBO.exe
PID 564 wrote to memory of 4372	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	UtGyPQj.exe
PID 564 wrote to memory of 4372	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	UtGyPQj.exe
PID 564 wrote to memory of 1884	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	aXVduOR.exe
PID 564 wrote to memory of 1884	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	aXVduOR.exe
PID 564 wrote to memory of 1868	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	DdIBLuI.exe
PID 564 wrote to memory of 1868	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	DdIBLuI.exe
PID 564 wrote to memory of 4864	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nmbPpuW.exe
PID 564 wrote to memory of 4864	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	nmbPpuW.exe
PID 564 wrote to memory of 2412	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	onevXfS.exe
PID 564 wrote to memory of 2412	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	onevXfS.exe
PID 564 wrote to memory of 2540	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	wsGDcbN.exe
PID 564 wrote to memory of 2540	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	wsGDcbN.exe
PID 564 wrote to memory of 2264	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	fulODJi.exe
PID 564 wrote to memory of 2264	564	03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe	fulODJi.exe

C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c318f87a0d38fa5e29f5a91dac807f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System\PHzWtGZ.exe
  C:\Windows\System\PHzWtGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\WdmYsCJ.exe
  C:\Windows\System\WdmYsCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\ixKnPdR.exe
  C:\Windows\System\ixKnPdR.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\VdTLFnl.exe
  C:\Windows\System\VdTLFnl.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\xSubBrr.exe
  C:\Windows\System\xSubBrr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\Tiexlvh.exe
  C:\Windows\System\Tiexlvh.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\iyrGRee.exe
  C:\Windows\System\iyrGRee.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\iLtWcAs.exe
  C:\Windows\System\iLtWcAs.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\KKoAfPw.exe
  C:\Windows\System\KKoAfPw.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\sFnbeRF.exe
  C:\Windows\System\sFnbeRF.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\lSReJmJ.exe
  C:\Windows\System\lSReJmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\nliYJCC.exe
  C:\Windows\System\nliYJCC.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BLjkpgj.exe
  C:\Windows\System\BLjkpgj.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\anMJFkE.exe
  C:\Windows\System\anMJFkE.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\BKTSbxC.exe
  C:\Windows\System\BKTSbxC.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\VCFKiPH.exe
  C:\Windows\System\VCFKiPH.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\WuwiegC.exe
  C:\Windows\System\WuwiegC.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\FRLvPWF.exe
  C:\Windows\System\FRLvPWF.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\jEJXgNg.exe
  C:\Windows\System\jEJXgNg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ielurPd.exe
  C:\Windows\System\ielurPd.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\YyNOLXU.exe
  C:\Windows\System\YyNOLXU.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\ajazpdD.exe
  C:\Windows\System\ajazpdD.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\QvBHgcJ.exe
  C:\Windows\System\QvBHgcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\HlAZIBO.exe
  C:\Windows\System\HlAZIBO.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\UtGyPQj.exe
  C:\Windows\System\UtGyPQj.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\aXVduOR.exe
  C:\Windows\System\aXVduOR.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\DdIBLuI.exe
  C:\Windows\System\DdIBLuI.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\nmbPpuW.exe
  C:\Windows\System\nmbPpuW.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\onevXfS.exe
  C:\Windows\System\onevXfS.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wsGDcbN.exe
  C:\Windows\System\wsGDcbN.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\fulODJi.exe
  C:\Windows\System\fulODJi.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\XnhbrWW.exe
  C:\Windows\System\XnhbrWW.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\nLQXojG.exe
  C:\Windows\System\nLQXojG.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\xVPqpjl.exe
  C:\Windows\System\xVPqpjl.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\siKWGMH.exe
  C:\Windows\System\siKWGMH.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\BMOtGzB.exe
  C:\Windows\System\BMOtGzB.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\amLkRIl.exe
  C:\Windows\System\amLkRIl.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\qNHlgDC.exe
  C:\Windows\System\qNHlgDC.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\EwQZJCd.exe
  C:\Windows\System\EwQZJCd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\kIaniBl.exe
  C:\Windows\System\kIaniBl.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ZPuhGCQ.exe
  C:\Windows\System\ZPuhGCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\fHPoHlx.exe
  C:\Windows\System\fHPoHlx.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\dYvtyox.exe
  C:\Windows\System\dYvtyox.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\MsuVtiR.exe
  C:\Windows\System\MsuVtiR.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\dSjnMLc.exe
  C:\Windows\System\dSjnMLc.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KjTCKRp.exe
  C:\Windows\System\KjTCKRp.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\dHfoSpC.exe
  C:\Windows\System\dHfoSpC.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\qUmLncM.exe
  C:\Windows\System\qUmLncM.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\QGVwqTb.exe
  C:\Windows\System\QGVwqTb.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\ViMegpl.exe
  C:\Windows\System\ViMegpl.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\CMKljQa.exe
  C:\Windows\System\CMKljQa.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\iCdQGRB.exe
  C:\Windows\System\iCdQGRB.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\PIrhwHX.exe
  C:\Windows\System\PIrhwHX.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\kOlSIbr.exe
  C:\Windows\System\kOlSIbr.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\buQBjKa.exe
  C:\Windows\System\buQBjKa.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\RzoExBT.exe
  C:\Windows\System\RzoExBT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\uUgcsDr.exe
  C:\Windows\System\uUgcsDr.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\HBSGzgg.exe
  C:\Windows\System\HBSGzgg.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ImXIHiN.exe
  C:\Windows\System\ImXIHiN.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\rfCkhuM.exe
  C:\Windows\System\rfCkhuM.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\FARscMv.exe
  C:\Windows\System\FARscMv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\pALXsXp.exe
  C:\Windows\System\pALXsXp.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\WXgzLGe.exe
  C:\Windows\System\WXgzLGe.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\KmPSIsY.exe
  C:\Windows\System\KmPSIsY.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\QsJoWZz.exe
  C:\Windows\System\QsJoWZz.exe
  2⤵
  PID:888
- C:\Windows\System\exZIdFy.exe
  C:\Windows\System\exZIdFy.exe
  2⤵
  PID:2448
- C:\Windows\System\PkKSgmQ.exe
  C:\Windows\System\PkKSgmQ.exe
  2⤵
  PID:1408
- C:\Windows\System\mEESJOp.exe
  C:\Windows\System\mEESJOp.exe
  2⤵
  PID:2668
- C:\Windows\System\cBfUMnu.exe
  C:\Windows\System\cBfUMnu.exe
  2⤵
  PID:4960
- C:\Windows\System\zVXjZnb.exe
  C:\Windows\System\zVXjZnb.exe
  2⤵
  PID:1960
- C:\Windows\System\HOohTBY.exe
  C:\Windows\System\HOohTBY.exe
  2⤵
  PID:2148
- C:\Windows\System\ubsGBWY.exe
  C:\Windows\System\ubsGBWY.exe
  2⤵
  PID:3056
- C:\Windows\System\UmpZiWW.exe
  C:\Windows\System\UmpZiWW.exe
  2⤵
  PID:4540
- C:\Windows\System\jhIdopV.exe
  C:\Windows\System\jhIdopV.exe
  2⤵
  PID:5144
- C:\Windows\System\GUsLgoV.exe
  C:\Windows\System\GUsLgoV.exe
  2⤵
  PID:5172
- C:\Windows\System\WzgettC.exe
  C:\Windows\System\WzgettC.exe
  2⤵
  PID:5200
- C:\Windows\System\sNwrFYp.exe
  C:\Windows\System\sNwrFYp.exe
  2⤵
  PID:5224
- C:\Windows\System\uUqdrLk.exe
  C:\Windows\System\uUqdrLk.exe
  2⤵
  PID:5252
- C:\Windows\System\tQEquTJ.exe
  C:\Windows\System\tQEquTJ.exe
  2⤵
  PID:5280
- C:\Windows\System\PHcqrIm.exe
  C:\Windows\System\PHcqrIm.exe
  2⤵
  PID:5308
- C:\Windows\System\KyPbyMK.exe
  C:\Windows\System\KyPbyMK.exe
  2⤵
  PID:5336
- C:\Windows\System\hWnAVkn.exe
  C:\Windows\System\hWnAVkn.exe
  2⤵
  PID:5360
- C:\Windows\System\dlshDDC.exe
  C:\Windows\System\dlshDDC.exe
  2⤵
  PID:5392
- C:\Windows\System\dGVeNWe.exe
  C:\Windows\System\dGVeNWe.exe
  2⤵
  PID:5416
- C:\Windows\System\qiKINer.exe
  C:\Windows\System\qiKINer.exe
  2⤵
  PID:5444
- C:\Windows\System\mIfcQyK.exe
  C:\Windows\System\mIfcQyK.exe
  2⤵
  PID:5472
- C:\Windows\System\NPbqepw.exe
  C:\Windows\System\NPbqepw.exe
  2⤵
  PID:5504
- C:\Windows\System\exhzRfw.exe
  C:\Windows\System\exhzRfw.exe
  2⤵
  PID:5532
- C:\Windows\System\lVUHjpe.exe
  C:\Windows\System\lVUHjpe.exe
  2⤵
  PID:5560
- C:\Windows\System\RNZqyrf.exe
  C:\Windows\System\RNZqyrf.exe
  2⤵
  PID:5588
- C:\Windows\System\olagvhD.exe
  C:\Windows\System\olagvhD.exe
  2⤵
  PID:5620
- C:\Windows\System\irKBWHY.exe
  C:\Windows\System\irKBWHY.exe
  2⤵
  PID:5644
- C:\Windows\System\iyzTbyO.exe
  C:\Windows\System\iyzTbyO.exe
  2⤵
  PID:5672
- C:\Windows\System\IQKHihz.exe
  C:\Windows\System\IQKHihz.exe
  2⤵
  PID:5700
- C:\Windows\System\KWrNBvG.exe
  C:\Windows\System\KWrNBvG.exe
  2⤵
  PID:5728
- C:\Windows\System\PEkInJG.exe
  C:\Windows\System\PEkInJG.exe
  2⤵
  PID:5756
- C:\Windows\System\YTtsyeg.exe
  C:\Windows\System\YTtsyeg.exe
  2⤵
  PID:5784
- C:\Windows\System\qNyThbT.exe
  C:\Windows\System\qNyThbT.exe
  2⤵
  PID:5812
- C:\Windows\System\BdlWaDu.exe
  C:\Windows\System\BdlWaDu.exe
  2⤵
  PID:5840
- C:\Windows\System\XmWwzuM.exe
  C:\Windows\System\XmWwzuM.exe
  2⤵
  PID:5864
- C:\Windows\System\ILmTMHq.exe
  C:\Windows\System\ILmTMHq.exe
  2⤵
  PID:5916
- C:\Windows\System\fLSbpnQ.exe
  C:\Windows\System\fLSbpnQ.exe
  2⤵
  PID:5944
- C:\Windows\System\QBCiqbN.exe
  C:\Windows\System\QBCiqbN.exe
  2⤵
  PID:5960
- C:\Windows\System\RzVvFYi.exe
  C:\Windows\System\RzVvFYi.exe
  2⤵
  PID:5984
- C:\Windows\System\BQEPZLM.exe
  C:\Windows\System\BQEPZLM.exe
  2⤵
  PID:6012
- C:\Windows\System\JJWxqtA.exe
  C:\Windows\System\JJWxqtA.exe
  2⤵
  PID:6040
- C:\Windows\System\FMVhhJo.exe
  C:\Windows\System\FMVhhJo.exe
  2⤵
  PID:6068
- C:\Windows\System\mCJoMEu.exe
  C:\Windows\System\mCJoMEu.exe
  2⤵
  PID:6088
- C:\Windows\System\ZMwCWIv.exe
  C:\Windows\System\ZMwCWIv.exe
  2⤵
  PID:6116
- C:\Windows\System\sZKLbyH.exe
  C:\Windows\System\sZKLbyH.exe
  2⤵
  PID:4452
- C:\Windows\System\hYrDqCl.exe
  C:\Windows\System\hYrDqCl.exe
  2⤵
  PID:4704
- C:\Windows\System\LbWKcEm.exe
  C:\Windows\System\LbWKcEm.exe
  2⤵
  PID:1188
- C:\Windows\System\UZStofu.exe
  C:\Windows\System\UZStofu.exe
  2⤵
  PID:2260
- C:\Windows\System\eHbcYII.exe
  C:\Windows\System\eHbcYII.exe
  2⤵
  PID:5124
- C:\Windows\System\pFLkdXl.exe
  C:\Windows\System\pFLkdXl.exe
  2⤵
  PID:5188
- C:\Windows\System\xgPkxkm.exe
  C:\Windows\System\xgPkxkm.exe
  2⤵
  PID:5260
- C:\Windows\System\AZuBqQR.exe
  C:\Windows\System\AZuBqQR.exe
  2⤵
  PID:5300
- C:\Windows\System\bjVKxAK.exe
  C:\Windows\System\bjVKxAK.exe
  2⤵
  PID:5372
- C:\Windows\System\TfvqteI.exe
  C:\Windows\System\TfvqteI.exe
  2⤵
  PID:5408
- C:\Windows\System\CnhmADG.exe
  C:\Windows\System\CnhmADG.exe
  2⤵
  PID:5484
- C:\Windows\System\mpzbbqx.exe
  C:\Windows\System\mpzbbqx.exe
  2⤵
  PID:5524
- C:\Windows\System\JpDNbMW.exe
  C:\Windows\System\JpDNbMW.exe
  2⤵
  PID:5580
- C:\Windows\System\BVixYQS.exe
  C:\Windows\System\BVixYQS.exe
  2⤵
  PID:5632
- C:\Windows\System\VdmwKKM.exe
  C:\Windows\System\VdmwKKM.exe
  2⤵
  PID:5692
- C:\Windows\System\ofnkTtQ.exe
  C:\Windows\System\ofnkTtQ.exe
  2⤵
  PID:5744
- C:\Windows\System\fBkEqmt.exe
  C:\Windows\System\fBkEqmt.exe
  2⤵
  PID:5804
- C:\Windows\System\prlBylx.exe
  C:\Windows\System\prlBylx.exe
  2⤵
  PID:5860
- C:\Windows\System\eFLBxLz.exe
  C:\Windows\System\eFLBxLz.exe
  2⤵
  PID:5932
- C:\Windows\System\OcBBJbt.exe
  C:\Windows\System\OcBBJbt.exe
  2⤵
  PID:952
- C:\Windows\System\dxzxwWc.exe
  C:\Windows\System\dxzxwWc.exe
  2⤵
  PID:6036
- C:\Windows\System\OigaCCt.exe
  C:\Windows\System\OigaCCt.exe
  2⤵
  PID:6100
- C:\Windows\System\NdzAUin.exe
  C:\Windows\System\NdzAUin.exe
  2⤵
  PID:5152
- C:\Windows\System\qkHmTVW.exe
  C:\Windows\System\qkHmTVW.exe
  2⤵
  PID:5288
- C:\Windows\System\wGdMwjU.exe
  C:\Windows\System\wGdMwjU.exe
  2⤵
  PID:5328
- C:\Windows\System\RdKXTkx.exe
  C:\Windows\System\RdKXTkx.exe
  2⤵
  PID:4940
- C:\Windows\System\luILCam.exe
  C:\Windows\System\luILCam.exe
  2⤵
  PID:3116
- C:\Windows\System\GpUBIRf.exe
  C:\Windows\System\GpUBIRf.exe
  2⤵
  PID:5492
- C:\Windows\System\IxONPkb.exe
  C:\Windows\System\IxONPkb.exe
  2⤵
  PID:5604
- C:\Windows\System\xLcVgYa.exe
  C:\Windows\System\xLcVgYa.exe
  2⤵
  PID:2104
- C:\Windows\System\ymwXElF.exe
  C:\Windows\System\ymwXElF.exe
  2⤵
  PID:5720
- C:\Windows\System\gTQSyrN.exe
  C:\Windows\System\gTQSyrN.exe
  2⤵
  PID:5800
- C:\Windows\System\uEKcjmI.exe
  C:\Windows\System\uEKcjmI.exe
  2⤵
  PID:5848
- C:\Windows\System\NokVvEj.exe
  C:\Windows\System\NokVvEj.exe
  2⤵
  PID:4136
- C:\Windows\System\kkOPFbj.exe
  C:\Windows\System\kkOPFbj.exe
  2⤵
  PID:2736
- C:\Windows\System\TcTfhAl.exe
  C:\Windows\System\TcTfhAl.exe
  2⤵
  PID:3992
- C:\Windows\System\vuaezZP.exe
  C:\Windows\System\vuaezZP.exe
  2⤵
  PID:6008
- C:\Windows\System\KvFtTUy.exe
  C:\Windows\System\KvFtTUy.exe
  2⤵
  PID:3052
- C:\Windows\System\EjPttYY.exe
  C:\Windows\System\EjPttYY.exe
  2⤵
  PID:4088
- C:\Windows\System\exjHEDY.exe
  C:\Windows\System\exjHEDY.exe
  2⤵
  PID:3272
- C:\Windows\System\iIJYOXI.exe
  C:\Windows\System\iIJYOXI.exe
  2⤵
  PID:1668
- C:\Windows\System\LxrwUvT.exe
  C:\Windows\System\LxrwUvT.exe
  2⤵
  PID:5680
- C:\Windows\System\BJtFaKs.exe
  C:\Windows\System\BJtFaKs.exe
  2⤵
  PID:5664
- C:\Windows\System\bHcjxSq.exe
  C:\Windows\System\bHcjxSq.exe
  2⤵
  PID:2004
- C:\Windows\System\zbUEGuj.exe
  C:\Windows\System\zbUEGuj.exe
  2⤵
  PID:3920
- C:\Windows\System\URjYMGL.exe
  C:\Windows\System\URjYMGL.exe
  2⤵
  PID:6152
- C:\Windows\System\nVbRhZR.exe
  C:\Windows\System\nVbRhZR.exe
  2⤵
  PID:6168
- C:\Windows\System\ORRfQIo.exe
  C:\Windows\System\ORRfQIo.exe
  2⤵
  PID:6196
- C:\Windows\System\cfTKXqR.exe
  C:\Windows\System\cfTKXqR.exe
  2⤵
  PID:6224
- C:\Windows\System\dFSvaul.exe
  C:\Windows\System\dFSvaul.exe
  2⤵
  PID:6276
- C:\Windows\System\XFiWESb.exe
  C:\Windows\System\XFiWESb.exe
  2⤵
  PID:6312
- C:\Windows\System\iqkFjZC.exe
  C:\Windows\System\iqkFjZC.exe
  2⤵
  PID:6356
- C:\Windows\System\ORwYxFe.exe
  C:\Windows\System\ORwYxFe.exe
  2⤵
  PID:6384
- C:\Windows\System\OPUXyXv.exe
  C:\Windows\System\OPUXyXv.exe
  2⤵
  PID:6408
- C:\Windows\System\decmXye.exe
  C:\Windows\System\decmXye.exe
  2⤵
  PID:6440
- C:\Windows\System\dVUsgoW.exe
  C:\Windows\System\dVUsgoW.exe
  2⤵
  PID:6472
- C:\Windows\System\EDnDpHp.exe
  C:\Windows\System\EDnDpHp.exe
  2⤵
  PID:6524
- C:\Windows\System\kVBtmwb.exe
  C:\Windows\System\kVBtmwb.exe
  2⤵
  PID:6564
- C:\Windows\System\prwRkFl.exe
  C:\Windows\System\prwRkFl.exe
  2⤵
  PID:6608
- C:\Windows\System\dAolykz.exe
  C:\Windows\System\dAolykz.exe
  2⤵
  PID:6636
- C:\Windows\System\izSPxnc.exe
  C:\Windows\System\izSPxnc.exe
  2⤵
  PID:6660
- C:\Windows\System\YYeNulk.exe
  C:\Windows\System\YYeNulk.exe
  2⤵
  PID:6696
- C:\Windows\System\UCRLONT.exe
  C:\Windows\System\UCRLONT.exe
  2⤵
  PID:6720
- C:\Windows\System\vuYqtrk.exe
  C:\Windows\System\vuYqtrk.exe
  2⤵
  PID:6736
- C:\Windows\System\HxLwODh.exe
  C:\Windows\System\HxLwODh.exe
  2⤵
  PID:6756
- C:\Windows\System\VPlOgsD.exe
  C:\Windows\System\VPlOgsD.exe
  2⤵
  PID:6772
- C:\Windows\System\DmSaGim.exe
  C:\Windows\System\DmSaGim.exe
  2⤵
  PID:6788
- C:\Windows\System\leVoIPp.exe
  C:\Windows\System\leVoIPp.exe
  2⤵
  PID:6816
- C:\Windows\System\lMCTkKQ.exe
  C:\Windows\System\lMCTkKQ.exe
  2⤵
  PID:6848
- C:\Windows\System\wLJUPJi.exe
  C:\Windows\System\wLJUPJi.exe
  2⤵
  PID:6868
- C:\Windows\System\cFseGzM.exe
  C:\Windows\System\cFseGzM.exe
  2⤵
  PID:6904
- C:\Windows\System\ciQSBEw.exe
  C:\Windows\System\ciQSBEw.exe
  2⤵
  PID:6932
- C:\Windows\System\AVrxgFk.exe
  C:\Windows\System\AVrxgFk.exe
  2⤵
  PID:6992
- C:\Windows\System\Turhyhk.exe
  C:\Windows\System\Turhyhk.exe
  2⤵
  PID:7012
- C:\Windows\System\yYxJMfa.exe
  C:\Windows\System\yYxJMfa.exe
  2⤵
  PID:7040
- C:\Windows\System\SNggpFK.exe
  C:\Windows\System\SNggpFK.exe
  2⤵
  PID:7084
- C:\Windows\System\mBYGzKN.exe
  C:\Windows\System\mBYGzKN.exe
  2⤵
  PID:7108
- C:\Windows\System\gDtgNkJ.exe
  C:\Windows\System\gDtgNkJ.exe
  2⤵
  PID:7128
- C:\Windows\System\QZEyQNb.exe
  C:\Windows\System\QZEyQNb.exe
  2⤵
  PID:7152
- C:\Windows\System\uCIVuYO.exe
  C:\Windows\System\uCIVuYO.exe
  2⤵
  PID:5568
- C:\Windows\System\mhGRKdU.exe
  C:\Windows\System\mhGRKdU.exe
  2⤵
  PID:2680
- C:\Windows\System\gkfXMPA.exe
  C:\Windows\System\gkfXMPA.exe
  2⤵
  PID:6180
- C:\Windows\System\BITBqHn.exe
  C:\Windows\System\BITBqHn.exe
  2⤵
  PID:6216
- C:\Windows\System\MJaePOj.exe
  C:\Windows\System\MJaePOj.exe
  2⤵
  PID:3468
- C:\Windows\System\OBMDamw.exe
  C:\Windows\System\OBMDamw.exe
  2⤵
  PID:6348
- C:\Windows\System\MhjYgfH.exe
  C:\Windows\System\MhjYgfH.exe
  2⤵
  PID:6392
- C:\Windows\System\YgUJZKd.exe
  C:\Windows\System\YgUJZKd.exe
  2⤵
  PID:6532
- C:\Windows\System\eUYivZo.exe
  C:\Windows\System\eUYivZo.exe
  2⤵
  PID:3196
- C:\Windows\System\qNkIlLa.exe
  C:\Windows\System\qNkIlLa.exe
  2⤵
  PID:6628
- C:\Windows\System\MeeImrh.exe
  C:\Windows\System\MeeImrh.exe
  2⤵
  PID:6684
- C:\Windows\System\KFfiUwC.exe
  C:\Windows\System\KFfiUwC.exe
  2⤵
  PID:6732
- C:\Windows\System\IekMkIQ.exe
  C:\Windows\System\IekMkIQ.exe
  2⤵
  PID:6780
- C:\Windows\System\nCDOHRD.exe
  C:\Windows\System\nCDOHRD.exe
  2⤵
  PID:4660
- C:\Windows\System\nVThxTN.exe
  C:\Windows\System\nVThxTN.exe
  2⤵
  PID:6912
- C:\Windows\System\XLBzFwA.exe
  C:\Windows\System\XLBzFwA.exe
  2⤵
  PID:6960
- C:\Windows\System\AhIizrv.exe
  C:\Windows\System\AhIizrv.exe
  2⤵
  PID:4152
- C:\Windows\System\GVQHqqn.exe
  C:\Windows\System\GVQHqqn.exe
  2⤵
  PID:4020
- C:\Windows\System\eeQfOOJ.exe
  C:\Windows\System\eeQfOOJ.exe
  2⤵
  PID:7072
- C:\Windows\System\LRjqPkS.exe
  C:\Windows\System\LRjqPkS.exe
  2⤵
  PID:6232
- C:\Windows\System\skhCjkP.exe
  C:\Windows\System\skhCjkP.exe
  2⤵
  PID:6212
- C:\Windows\System\kbhaeMw.exe
  C:\Windows\System\kbhaeMw.exe
  2⤵
  PID:6336
- C:\Windows\System\GJmKkbs.exe
  C:\Windows\System\GJmKkbs.exe
  2⤵
  PID:4888
- C:\Windows\System\cuenYvN.exe
  C:\Windows\System\cuenYvN.exe
  2⤵
  PID:6488
- C:\Windows\System\RsnGfxW.exe
  C:\Windows\System\RsnGfxW.exe
  2⤵
  PID:6604
- C:\Windows\System\CSJfnIu.exe
  C:\Windows\System\CSJfnIu.exe
  2⤵
  PID:6924
- C:\Windows\System\iCkdzQy.exe
  C:\Windows\System\iCkdzQy.exe
  2⤵
  PID:5164
- C:\Windows\System\OONJoPZ.exe
  C:\Windows\System\OONJoPZ.exe
  2⤵
  PID:7104
- C:\Windows\System\CDmaSXN.exe
  C:\Windows\System\CDmaSXN.exe
  2⤵
  PID:6176
- C:\Windows\System\nKPnSvt.exe
  C:\Windows\System\nKPnSvt.exe
  2⤵
  PID:6576
- C:\Windows\System\fikeGBw.exe
  C:\Windows\System\fikeGBw.exe
  2⤵
  PID:6656
- C:\Windows\System\Aahhbmi.exe
  C:\Windows\System\Aahhbmi.exe
  2⤵
  PID:6836
- C:\Windows\System\SROtKEX.exe
  C:\Windows\System\SROtKEX.exe
  2⤵
  PID:5552
- C:\Windows\System\hbnkSTe.exe
  C:\Windows\System\hbnkSTe.exe
  2⤵
  PID:4740
- C:\Windows\System\xdYktgY.exe
  C:\Windows\System\xdYktgY.exe
  2⤵
  PID:6372
- C:\Windows\System\NXvAlGW.exe
  C:\Windows\System\NXvAlGW.exe
  2⤵
  PID:3124
- C:\Windows\System\cfgYyIk.exe
  C:\Windows\System\cfgYyIk.exe
  2⤵
  PID:7184
- C:\Windows\System\RBhzvhn.exe
  C:\Windows\System\RBhzvhn.exe
  2⤵
  PID:7208
- C:\Windows\System\pWitmWK.exe
  C:\Windows\System\pWitmWK.exe
  2⤵
  PID:7272
- C:\Windows\System\cMHjxeQ.exe
  C:\Windows\System\cMHjxeQ.exe
  2⤵
  PID:7316
- C:\Windows\System\dKKyNfe.exe
  C:\Windows\System\dKKyNfe.exe
  2⤵
  PID:7332
- C:\Windows\System\WplzfTm.exe
  C:\Windows\System\WplzfTm.exe
  2⤵
  PID:7356
- C:\Windows\System\dHlMARi.exe
  C:\Windows\System\dHlMARi.exe
  2⤵
  PID:7388
- C:\Windows\System\MWvxoMi.exe
  C:\Windows\System\MWvxoMi.exe
  2⤵
  PID:7420
- C:\Windows\System\imJaiRi.exe
  C:\Windows\System\imJaiRi.exe
  2⤵
  PID:7436
- C:\Windows\System\tlcKhKj.exe
  C:\Windows\System\tlcKhKj.exe
  2⤵
  PID:7460
- C:\Windows\System\dVznjOy.exe
  C:\Windows\System\dVznjOy.exe
  2⤵
  PID:7480
- C:\Windows\System\TdXgPfU.exe
  C:\Windows\System\TdXgPfU.exe
  2⤵
  PID:7504
- C:\Windows\System\kcYrBhj.exe
  C:\Windows\System\kcYrBhj.exe
  2⤵
  PID:7524
- C:\Windows\System\OPSIsVa.exe
  C:\Windows\System\OPSIsVa.exe
  2⤵
  PID:7544
- C:\Windows\System\rIBcFlc.exe
  C:\Windows\System\rIBcFlc.exe
  2⤵
  PID:7588
- C:\Windows\System\amqfEeX.exe
  C:\Windows\System\amqfEeX.exe
  2⤵
  PID:7616
- C:\Windows\System\bCmDXrU.exe
  C:\Windows\System\bCmDXrU.exe
  2⤵
  PID:7672
- C:\Windows\System\rhNjuyy.exe
  C:\Windows\System\rhNjuyy.exe
  2⤵
  PID:7688
- C:\Windows\System\tBWRmFo.exe
  C:\Windows\System\tBWRmFo.exe
  2⤵
  PID:7728
- C:\Windows\System\pvNEGxR.exe
  C:\Windows\System\pvNEGxR.exe
  2⤵
  PID:7752
- C:\Windows\System\yYGIpSd.exe
  C:\Windows\System\yYGIpSd.exe
  2⤵
  PID:7780
- C:\Windows\System\dCqUmmW.exe
  C:\Windows\System\dCqUmmW.exe
  2⤵
  PID:7804
- C:\Windows\System\QIdDRct.exe
  C:\Windows\System\QIdDRct.exe
  2⤵
  PID:7824
- C:\Windows\System\cUFWUCU.exe
  C:\Windows\System\cUFWUCU.exe
  2⤵
  PID:7856
- C:\Windows\System\TKfZBYb.exe
  C:\Windows\System\TKfZBYb.exe
  2⤵
  PID:7884
- C:\Windows\System\GZxvIad.exe
  C:\Windows\System\GZxvIad.exe
  2⤵
  PID:7912
- C:\Windows\System\SGgdvup.exe
  C:\Windows\System\SGgdvup.exe
  2⤵
  PID:7936
- C:\Windows\System\fjrvqJq.exe
  C:\Windows\System\fjrvqJq.exe
  2⤵
  PID:7992
- C:\Windows\System\uFlnOIq.exe
  C:\Windows\System\uFlnOIq.exe
  2⤵
  PID:8012
- C:\Windows\System\tnuwBpX.exe
  C:\Windows\System\tnuwBpX.exe
  2⤵
  PID:8052
- C:\Windows\System\BIDDBen.exe
  C:\Windows\System\BIDDBen.exe
  2⤵
  PID:8072
- C:\Windows\System\moSbXKV.exe
  C:\Windows\System\moSbXKV.exe
  2⤵
  PID:8088
- C:\Windows\System\vVZhvxR.exe
  C:\Windows\System\vVZhvxR.exe
  2⤵
  PID:8128
- C:\Windows\System\qNaHKTK.exe
  C:\Windows\System\qNaHKTK.exe
  2⤵
  PID:8156
- C:\Windows\System\ZUtCnXq.exe
  C:\Windows\System\ZUtCnXq.exe
  2⤵
  PID:8180
- C:\Windows\System\bFSSRWn.exe
  C:\Windows\System\bFSSRWn.exe
  2⤵
  PID:4204
- C:\Windows\System\dfEWErI.exe
  C:\Windows\System\dfEWErI.exe
  2⤵
  PID:7172
- C:\Windows\System\AjiIJPa.exe
  C:\Windows\System\AjiIJPa.exe
  2⤵
  PID:7192
- C:\Windows\System\XtLBECd.exe
  C:\Windows\System\XtLBECd.exe
  2⤵
  PID:7312
- C:\Windows\System\yxBOaoj.exe
  C:\Windows\System\yxBOaoj.exe
  2⤵
  PID:7384
- C:\Windows\System\jMCPbsZ.exe
  C:\Windows\System\jMCPbsZ.exe
  2⤵
  PID:7492
- C:\Windows\System\uSfPznU.exe
  C:\Windows\System\uSfPznU.exe
  2⤵
  PID:7532
- C:\Windows\System\QUydKfS.exe
  C:\Windows\System\QUydKfS.exe
  2⤵
  PID:7572
- C:\Windows\System\MPgaVYv.exe
  C:\Windows\System\MPgaVYv.exe
  2⤵
  PID:7664
- C:\Windows\System\efosCpP.exe
  C:\Windows\System\efosCpP.exe
  2⤵
  PID:7720
- C:\Windows\System\swggPlS.exe
  C:\Windows\System\swggPlS.exe
  2⤵
  PID:7832
- C:\Windows\System\jGLgxDy.exe
  C:\Windows\System\jGLgxDy.exe
  2⤵
  PID:7812
- C:\Windows\System\drRFqjy.exe
  C:\Windows\System\drRFqjy.exe
  2⤵
  PID:7880
- C:\Windows\System\CWEIXIe.exe
  C:\Windows\System\CWEIXIe.exe
  2⤵
  PID:7960
- C:\Windows\System\LUDXmgH.exe
  C:\Windows\System\LUDXmgH.exe
  2⤵
  PID:8044
- C:\Windows\System\sbDPdMb.exe
  C:\Windows\System\sbDPdMb.exe
  2⤵
  PID:8084
- C:\Windows\System\lwDkKiC.exe
  C:\Windows\System\lwDkKiC.exe
  2⤵
  PID:8136
- C:\Windows\System\rwrrHiK.exe
  C:\Windows\System\rwrrHiK.exe
  2⤵
  PID:8172
- C:\Windows\System\fqLZuyI.exe
  C:\Windows\System\fqLZuyI.exe
  2⤵
  PID:6556
- C:\Windows\System\xcvtmts.exe
  C:\Windows\System\xcvtmts.exe
  2⤵
  PID:5104
- C:\Windows\System\lrQWnDM.exe
  C:\Windows\System\lrQWnDM.exe
  2⤵
  PID:7408
- C:\Windows\System\xFqkWID.exe
  C:\Windows\System\xFqkWID.exe
  2⤵
  PID:7520
- C:\Windows\System\GAOfMHd.exe
  C:\Windows\System\GAOfMHd.exe
  2⤵
  PID:7660
- C:\Windows\System\gSZstaX.exe
  C:\Windows\System\gSZstaX.exe
  2⤵
  PID:7800
- C:\Windows\System\llWcski.exe
  C:\Windows\System\llWcski.exe
  2⤵
  PID:8024
- C:\Windows\System\vkirIqc.exe
  C:\Windows\System\vkirIqc.exe
  2⤵
  PID:7092
- C:\Windows\System\GGLVghf.exe
  C:\Windows\System\GGLVghf.exe
  2⤵
  PID:3476
- C:\Windows\System\ygaQfnK.exe
  C:\Windows\System\ygaQfnK.exe
  2⤵
  PID:7652
- C:\Windows\System\yAIUjjn.exe
  C:\Windows\System\yAIUjjn.exe
  2⤵
  PID:7820
- C:\Windows\System\YCCHUrN.exe
  C:\Windows\System\YCCHUrN.exe
  2⤵
  PID:8104
- C:\Windows\System\qpqPgHR.exe
  C:\Windows\System\qpqPgHR.exe
  2⤵
  PID:8216
- C:\Windows\System\HFcwLWb.exe
  C:\Windows\System\HFcwLWb.exe
  2⤵
  PID:8240
- C:\Windows\System\sYQjPGK.exe
  C:\Windows\System\sYQjPGK.exe
  2⤵
  PID:8276
- C:\Windows\System\vwgZOZN.exe
  C:\Windows\System\vwgZOZN.exe
  2⤵
  PID:8304
- C:\Windows\System\UyGSIHr.exe
  C:\Windows\System\UyGSIHr.exe
  2⤵
  PID:8324
- C:\Windows\System\qrHqZnI.exe
  C:\Windows\System\qrHqZnI.exe
  2⤵
  PID:8344
- C:\Windows\System\VWhhZJs.exe
  C:\Windows\System\VWhhZJs.exe
  2⤵
  PID:8376
- C:\Windows\System\QOoigPJ.exe
  C:\Windows\System\QOoigPJ.exe
  2⤵
  PID:8416
- C:\Windows\System\jATKRED.exe
  C:\Windows\System\jATKRED.exe
  2⤵
  PID:8444
- C:\Windows\System\RxfqMGd.exe
  C:\Windows\System\RxfqMGd.exe
  2⤵
  PID:8468
- C:\Windows\System\HKPJmox.exe
  C:\Windows\System\HKPJmox.exe
  2⤵
  PID:8508
- C:\Windows\System\XOcdVQD.exe
  C:\Windows\System\XOcdVQD.exe
  2⤵
  PID:8528
- C:\Windows\System\xkmbJOj.exe
  C:\Windows\System\xkmbJOj.exe
  2⤵
  PID:8552
- C:\Windows\System\MXKBhzi.exe
  C:\Windows\System\MXKBhzi.exe
  2⤵
  PID:8572
- C:\Windows\System\oRtlXAm.exe
  C:\Windows\System\oRtlXAm.exe
  2⤵
  PID:8600
- C:\Windows\System\KDsoEDC.exe
  C:\Windows\System\KDsoEDC.exe
  2⤵
  PID:8624
- C:\Windows\System\gaToTsi.exe
  C:\Windows\System\gaToTsi.exe
  2⤵
  PID:8664
- C:\Windows\System\onfYdQA.exe
  C:\Windows\System\onfYdQA.exe
  2⤵
  PID:8684
- C:\Windows\System\mQtNlIt.exe
  C:\Windows\System\mQtNlIt.exe
  2⤵
  PID:8712
- C:\Windows\System\nJEgJaI.exe
  C:\Windows\System\nJEgJaI.exe
  2⤵
  PID:8752
- C:\Windows\System\GJmlvLQ.exe
  C:\Windows\System\GJmlvLQ.exe
  2⤵
  PID:8768
- C:\Windows\System\KbBxqAt.exe
  C:\Windows\System\KbBxqAt.exe
  2⤵
  PID:8800
- C:\Windows\System\xdovxXU.exe
  C:\Windows\System\xdovxXU.exe
  2⤵
  PID:8820
- C:\Windows\System\llTtosf.exe
  C:\Windows\System\llTtosf.exe
  2⤵
  PID:8840
- C:\Windows\System\pOxGaJM.exe
  C:\Windows\System\pOxGaJM.exe
  2⤵
  PID:8892
- C:\Windows\System\vkTiGOn.exe
  C:\Windows\System\vkTiGOn.exe
  2⤵
  PID:8916
- C:\Windows\System\OLYcBUg.exe
  C:\Windows\System\OLYcBUg.exe
  2⤵
  PID:8956
- C:\Windows\System\RNVqzzE.exe
  C:\Windows\System\RNVqzzE.exe
  2⤵
  PID:8980
- C:\Windows\System\ZjfzCcO.exe
  C:\Windows\System\ZjfzCcO.exe
  2⤵
  PID:9016
- C:\Windows\System\qpVLMVt.exe
  C:\Windows\System\qpVLMVt.exe
  2⤵
  PID:9036
- C:\Windows\System\ifNlZCI.exe
  C:\Windows\System\ifNlZCI.exe
  2⤵
  PID:9076
- C:\Windows\System\eDmPrMG.exe
  C:\Windows\System\eDmPrMG.exe
  2⤵
  PID:9092
- C:\Windows\System\EBvPyaJ.exe
  C:\Windows\System\EBvPyaJ.exe
  2⤵
  PID:9108
- C:\Windows\System\QzSGbIE.exe
  C:\Windows\System\QzSGbIE.exe
  2⤵
  PID:9132
- C:\Windows\System\LQaKnSt.exe
  C:\Windows\System\LQaKnSt.exe
  2⤵
  PID:9156
- C:\Windows\System\TnTIhsp.exe
  C:\Windows\System\TnTIhsp.exe
  2⤵
  PID:9180
- C:\Windows\System\qWBabMj.exe
  C:\Windows\System\qWBabMj.exe
  2⤵
  PID:8208
- C:\Windows\System\bGOkgSB.exe
  C:\Windows\System\bGOkgSB.exe
  2⤵
  PID:8232
- C:\Windows\System\dBwGxOy.exe
  C:\Windows\System\dBwGxOy.exe
  2⤵
  PID:8272
- C:\Windows\System\DdSYlLd.exe
  C:\Windows\System\DdSYlLd.exe
  2⤵
  PID:8392
- C:\Windows\System\baPyUEr.exe
  C:\Windows\System\baPyUEr.exe
  2⤵
  PID:8456
- C:\Windows\System\TSIfsiE.exe
  C:\Windows\System\TSIfsiE.exe
  2⤵
  PID:8500
- C:\Windows\System\uJEgoch.exe
  C:\Windows\System\uJEgoch.exe
  2⤵
  PID:8540
- C:\Windows\System\fBDGQOI.exe
  C:\Windows\System\fBDGQOI.exe
  2⤵
  PID:8592
- C:\Windows\System\SCdZPpx.exe
  C:\Windows\System\SCdZPpx.exe
  2⤵
  PID:8680
- C:\Windows\System\qYDBWdb.exe
  C:\Windows\System\qYDBWdb.exe
  2⤵
  PID:8760
- C:\Windows\System\qwSuFoc.exe
  C:\Windows\System\qwSuFoc.exe
  2⤵
  PID:8792
- C:\Windows\System\hbFxqsk.exe
  C:\Windows\System\hbFxqsk.exe
  2⤵
  PID:8864
- C:\Windows\System\FCJIGvk.exe
  C:\Windows\System\FCJIGvk.exe
  2⤵
  PID:8904
- C:\Windows\System\RVcCaoY.exe
  C:\Windows\System\RVcCaoY.exe
  2⤵
  PID:9004
- C:\Windows\System\iMVdmli.exe
  C:\Windows\System\iMVdmli.exe
  2⤵
  PID:9064
- C:\Windows\System\LUWZTFr.exe
  C:\Windows\System\LUWZTFr.exe
  2⤵
  PID:9100
- C:\Windows\System\xIvuhvt.exe
  C:\Windows\System\xIvuhvt.exe
  2⤵
  PID:9152
- C:\Windows\System\VdvsfzK.exe
  C:\Windows\System\VdvsfzK.exe
  2⤵
  PID:4240
- C:\Windows\System\sbwkWpQ.exe
  C:\Windows\System\sbwkWpQ.exe
  2⤵
  PID:8484
- C:\Windows\System\dazuIqG.exe
  C:\Windows\System\dazuIqG.exe
  2⤵
  PID:8524
- C:\Windows\System\MKAoWoe.exe
  C:\Windows\System\MKAoWoe.exe
  2⤵
  PID:8776
- C:\Windows\System\AfBwERM.exe
  C:\Windows\System\AfBwERM.exe
  2⤵
  PID:8952
- C:\Windows\System\rvfOHKW.exe
  C:\Windows\System\rvfOHKW.exe
  2⤵
  PID:9120
- C:\Windows\System\YLGPDOP.exe
  C:\Windows\System\YLGPDOP.exe
  2⤵
  PID:9128
- C:\Windows\System\VHuuVqU.exe
  C:\Windows\System\VHuuVqU.exe
  2⤵
  PID:8224
- C:\Windows\System\rELAwew.exe
  C:\Windows\System\rELAwew.exe
  2⤵
  PID:8336
- C:\Windows\System\BOtVinJ.exe
  C:\Windows\System\BOtVinJ.exe
  2⤵
  PID:9084
- C:\Windows\System\TTVNoOi.exe
  C:\Windows\System\TTVNoOi.exe
  2⤵
  PID:9264
- C:\Windows\System\mFnIrol.exe
  C:\Windows\System\mFnIrol.exe
  2⤵
  PID:9280
- C:\Windows\System\EwZgZNl.exe
  C:\Windows\System\EwZgZNl.exe
  2⤵
  PID:9296
- C:\Windows\System\wGLqiaw.exe
  C:\Windows\System\wGLqiaw.exe
  2⤵
  PID:9312
- C:\Windows\System\cBeiToE.exe
  C:\Windows\System\cBeiToE.exe
  2⤵
  PID:9332
- C:\Windows\System\jIQkIMz.exe
  C:\Windows\System\jIQkIMz.exe
  2⤵
  PID:9348
- C:\Windows\System\gZffxsy.exe
  C:\Windows\System\gZffxsy.exe
  2⤵
  PID:9444
- C:\Windows\System\FWgCvMj.exe
  C:\Windows\System\FWgCvMj.exe
  2⤵
  PID:9468
- C:\Windows\System\akkhVET.exe
  C:\Windows\System\akkhVET.exe
  2⤵
  PID:9508
- C:\Windows\System\veBYaAg.exe
  C:\Windows\System\veBYaAg.exe
  2⤵
  PID:9528
- C:\Windows\System\jybCOEn.exe
  C:\Windows\System\jybCOEn.exe
  2⤵
  PID:9544
- C:\Windows\System\fQUZsCN.exe
  C:\Windows\System\fQUZsCN.exe
  2⤵
  PID:9572
- C:\Windows\System\pBvoOqF.exe
  C:\Windows\System\pBvoOqF.exe
  2⤵
  PID:9628
- C:\Windows\System\qWAxQcn.exe
  C:\Windows\System\qWAxQcn.exe
  2⤵
  PID:9656
- C:\Windows\System\PgtZvhT.exe
  C:\Windows\System\PgtZvhT.exe
  2⤵
  PID:9672
- C:\Windows\System\oxoQXEf.exe
  C:\Windows\System\oxoQXEf.exe
  2⤵
  PID:9764
- C:\Windows\System\sGAtATk.exe
  C:\Windows\System\sGAtATk.exe
  2⤵
  PID:9796
- C:\Windows\System\Dvlvmss.exe
  C:\Windows\System\Dvlvmss.exe
  2⤵
  PID:9824
- C:\Windows\System\yFnfRAK.exe
  C:\Windows\System\yFnfRAK.exe
  2⤵
  PID:9848
- C:\Windows\System\nfStHva.exe
  C:\Windows\System\nfStHva.exe
  2⤵
  PID:9868
- C:\Windows\System\vPxwiIY.exe
  C:\Windows\System\vPxwiIY.exe
  2⤵
  PID:9892
- C:\Windows\System\cOQabdx.exe
  C:\Windows\System\cOQabdx.exe
  2⤵
  PID:9908
- C:\Windows\System\otamrnY.exe
  C:\Windows\System\otamrnY.exe
  2⤵
  PID:9928
- C:\Windows\System\dyHCOJF.exe
  C:\Windows\System\dyHCOJF.exe
  2⤵
  PID:9972
- C:\Windows\System\XzpcSfH.exe
  C:\Windows\System\XzpcSfH.exe
  2⤵
  PID:9988
- C:\Windows\System\dmBWgpc.exe
  C:\Windows\System\dmBWgpc.exe
  2⤵
  PID:10012
- C:\Windows\System\KzJwOcy.exe
  C:\Windows\System\KzJwOcy.exe
  2⤵
  PID:10060
- C:\Windows\System\vVjfcAO.exe
  C:\Windows\System\vVjfcAO.exe
  2⤵
  PID:10080
- C:\Windows\System\nMBvMYb.exe
  C:\Windows\System\nMBvMYb.exe
  2⤵
  PID:10116
- C:\Windows\System\FNbtqgQ.exe
  C:\Windows\System\FNbtqgQ.exe
  2⤵
  PID:10136
- C:\Windows\System\XZMieDL.exe
  C:\Windows\System\XZMieDL.exe
  2⤵
  PID:10164
- C:\Windows\System\FLYQMxl.exe
  C:\Windows\System\FLYQMxl.exe
  2⤵
  PID:10220
- C:\Windows\System\nnkhEEv.exe
  C:\Windows\System\nnkhEEv.exe
  2⤵
  PID:10236
- C:\Windows\System\ttDhrgi.exe
  C:\Windows\System\ttDhrgi.exe
  2⤵
  PID:9244
- C:\Windows\System\eWwnzkz.exe
  C:\Windows\System\eWwnzkz.exe
  2⤵
  PID:9272
- C:\Windows\System\QhAAESS.exe
  C:\Windows\System\QhAAESS.exe
  2⤵
  PID:9396
- C:\Windows\System\XLbrvCc.exe
  C:\Windows\System\XLbrvCc.exe
  2⤵
  PID:9224
- C:\Windows\System\SAWzEUD.exe
  C:\Windows\System\SAWzEUD.exe
  2⤵
  PID:9308
- C:\Windows\System\vhnvjyJ.exe
  C:\Windows\System\vhnvjyJ.exe
  2⤵
  PID:9412
- C:\Windows\System\ShBgZaj.exe
  C:\Windows\System\ShBgZaj.exe
  2⤵
  PID:9488
- C:\Windows\System\cUTxNLF.exe
  C:\Windows\System\cUTxNLF.exe
  2⤵
  PID:9464
- C:\Windows\System\LfDelzn.exe
  C:\Windows\System\LfDelzn.exe
  2⤵
  PID:9496
- C:\Windows\System\lJGBTfI.exe
  C:\Windows\System\lJGBTfI.exe
  2⤵
  PID:9608
- C:\Windows\System\lVuSNYz.exe
  C:\Windows\System\lVuSNYz.exe
  2⤵
  PID:9616
- C:\Windows\System\WAyywMj.exe
  C:\Windows\System\WAyywMj.exe
  2⤵
  PID:9780
- C:\Windows\System\kRXoeML.exe
  C:\Windows\System\kRXoeML.exe
  2⤵
  PID:9816
- C:\Windows\System\ogUZBTs.exe
  C:\Windows\System\ogUZBTs.exe
  2⤵
  PID:9836
- C:\Windows\System\VGKMRsU.exe
  C:\Windows\System\VGKMRsU.exe
  2⤵
  PID:9880
- C:\Windows\System\oGINvYB.exe
  C:\Windows\System\oGINvYB.exe
  2⤵
  PID:9952
- C:\Windows\System\GzuzzUm.exe
  C:\Windows\System\GzuzzUm.exe
  2⤵
  PID:10036
- C:\Windows\System\ofIuNpC.exe
  C:\Windows\System\ofIuNpC.exe
  2⤵
  PID:10096
- C:\Windows\System\oKRIkkz.exe
  C:\Windows\System\oKRIkkz.exe
  2⤵
  PID:10208
- C:\Windows\System\CfBQMCn.exe
  C:\Windows\System\CfBQMCn.exe
  2⤵
  PID:9028
- C:\Windows\System\IEcOxYi.exe
  C:\Windows\System\IEcOxYi.exe
  2⤵
  PID:9368
- C:\Windows\System\OURymVH.exe
  C:\Windows\System\OURymVH.exe
  2⤵
  PID:9440
- C:\Windows\System\oMaDCZC.exe
  C:\Windows\System\oMaDCZC.exe
  2⤵
  PID:9340
- C:\Windows\System\SJdatHX.exe
  C:\Windows\System\SJdatHX.exe
  2⤵
  PID:9552
- C:\Windows\System\MpliQUt.exe
  C:\Windows\System\MpliQUt.exe
  2⤵
  PID:9668
- C:\Windows\System\zkphEXS.exe
  C:\Windows\System\zkphEXS.exe
  2⤵
  PID:9900
- C:\Windows\System\eazPFcO.exe
  C:\Windows\System\eazPFcO.exe
  2⤵
  PID:10232
- C:\Windows\System\zvOwyMb.exe
  C:\Windows\System\zvOwyMb.exe
  2⤵
  PID:9388
- C:\Windows\System\HLSZwko.exe
  C:\Windows\System\HLSZwko.exe
  2⤵
  PID:9360
- C:\Windows\System\lzZmHJB.exe
  C:\Windows\System\lzZmHJB.exe
  2⤵
  PID:9516
- C:\Windows\System\PrKLNtN.exe
  C:\Windows\System\PrKLNtN.exe
  2⤵
  PID:9956
- C:\Windows\System\EOCjXNL.exe
  C:\Windows\System\EOCjXNL.exe
  2⤵
  PID:9208
- C:\Windows\System\olsWSOn.exe
  C:\Windows\System\olsWSOn.exe
  2⤵
  PID:9876
- C:\Windows\System\zruyQyN.exe
  C:\Windows\System\zruyQyN.exe
  2⤵
  PID:10248
- C:\Windows\System\BOskROI.exe
  C:\Windows\System\BOskROI.exe
  2⤵
  PID:10308
- C:\Windows\System\QjHDJuy.exe
  C:\Windows\System\QjHDJuy.exe
  2⤵
  PID:10328
- C:\Windows\System\ntzlKwf.exe
  C:\Windows\System\ntzlKwf.exe
  2⤵
  PID:10368
- C:\Windows\System\nSpnLuH.exe
  C:\Windows\System\nSpnLuH.exe
  2⤵
  PID:10384
- C:\Windows\System\AWtFxNR.exe
  C:\Windows\System\AWtFxNR.exe
  2⤵
  PID:10404
- C:\Windows\System\BQCQBuw.exe
  C:\Windows\System\BQCQBuw.exe
  2⤵
  PID:10436
- C:\Windows\System\qBaGoeD.exe
  C:\Windows\System\qBaGoeD.exe
  2⤵
  PID:10472
- C:\Windows\System\xXfwBAB.exe
  C:\Windows\System\xXfwBAB.exe
  2⤵
  PID:10496
- C:\Windows\System\AFHcAwE.exe
  C:\Windows\System\AFHcAwE.exe
  2⤵
  PID:10512
- C:\Windows\System\WjiYwto.exe
  C:\Windows\System\WjiYwto.exe
  2⤵
  PID:10556
- C:\Windows\System\bXPauGs.exe
  C:\Windows\System\bXPauGs.exe
  2⤵
  PID:10580
- C:\Windows\System\KURsAvz.exe
  C:\Windows\System\KURsAvz.exe
  2⤵
  PID:10604
- C:\Windows\System\qECQzSJ.exe
  C:\Windows\System\qECQzSJ.exe
  2⤵
  PID:10624
- C:\Windows\System\kYRNffZ.exe
  C:\Windows\System\kYRNffZ.exe
  2⤵
  PID:10676
- C:\Windows\System\mRCWBGD.exe
  C:\Windows\System\mRCWBGD.exe
  2⤵
  PID:10692
- C:\Windows\System\HDLgeuV.exe
  C:\Windows\System\HDLgeuV.exe
  2⤵
  PID:10716
- C:\Windows\System\VUhIvXZ.exe
  C:\Windows\System\VUhIvXZ.exe
  2⤵
  PID:10744
- C:\Windows\System\hFyOnUa.exe
  C:\Windows\System\hFyOnUa.exe
  2⤵
  PID:10768
- C:\Windows\System\ndweAap.exe
  C:\Windows\System\ndweAap.exe
  2⤵
  PID:10812
- C:\Windows\System\fVhKlPv.exe
  C:\Windows\System\fVhKlPv.exe
  2⤵
  PID:10848
- C:\Windows\System\zXyNhCX.exe
  C:\Windows\System\zXyNhCX.exe
  2⤵
  PID:10864
- C:\Windows\System\evoqKLn.exe
  C:\Windows\System\evoqKLn.exe
  2⤵
  PID:10904
- C:\Windows\System\xDZKzIB.exe
  C:\Windows\System\xDZKzIB.exe
  2⤵
  PID:10920
- C:\Windows\System\gWKEetj.exe
  C:\Windows\System\gWKEetj.exe
  2⤵
  PID:10948
- C:\Windows\System\ECjCZsD.exe
  C:\Windows\System\ECjCZsD.exe
  2⤵
  PID:10968
- C:\Windows\System\XEZEigM.exe
  C:\Windows\System\XEZEigM.exe
  2⤵
  PID:10996
- C:\Windows\System\uVvWwga.exe
  C:\Windows\System\uVvWwga.exe
  2⤵
  PID:11024
- C:\Windows\System\xXtYjCQ.exe
  C:\Windows\System\xXtYjCQ.exe
  2⤵
  PID:11044
- C:\Windows\System\OHaVMeM.exe
  C:\Windows\System\OHaVMeM.exe
  2⤵
  PID:11072
- C:\Windows\System\HmEOFzX.exe
  C:\Windows\System\HmEOFzX.exe
  2⤵
  PID:11088
- C:\Windows\System\hpsEQPA.exe
  C:\Windows\System\hpsEQPA.exe
  2⤵
  PID:11112
- C:\Windows\System\elcFMOr.exe
  C:\Windows\System\elcFMOr.exe
  2⤵
  PID:11164
- C:\Windows\System\BFDKwGj.exe
  C:\Windows\System\BFDKwGj.exe
  2⤵
  PID:11188
- C:\Windows\System\SDpDejU.exe
  C:\Windows\System\SDpDejU.exe
  2⤵
  PID:11252
- C:\Windows\System\mUsUgtn.exe
  C:\Windows\System\mUsUgtn.exe
  2⤵
  PID:10048
- C:\Windows\System\AnZERhs.exe
  C:\Windows\System\AnZERhs.exe
  2⤵
  PID:9808
- C:\Windows\System\yxfbdVJ.exe
  C:\Windows\System\yxfbdVJ.exe
  2⤵
  PID:10304
- C:\Windows\System\xaGdISR.exe
  C:\Windows\System\xaGdISR.exe
  2⤵
  PID:10344
- C:\Windows\System\hYPjjRB.exe
  C:\Windows\System\hYPjjRB.exe
  2⤵
  PID:10396
- C:\Windows\System\yATtuae.exe
  C:\Windows\System\yATtuae.exe
  2⤵
  PID:10452
- C:\Windows\System\smKqlod.exe
  C:\Windows\System\smKqlod.exe
  2⤵
  PID:10492
- C:\Windows\System\MPRnrNL.exe
  C:\Windows\System\MPRnrNL.exe
  2⤵
  PID:10576
- C:\Windows\System\MbXLzsB.exe
  C:\Windows\System\MbXLzsB.exe
  2⤵
  PID:10636
- C:\Windows\System\cPHPPZE.exe
  C:\Windows\System\cPHPPZE.exe
  2⤵
  PID:10712
- C:\Windows\System\TsiLClp.exe
  C:\Windows\System\TsiLClp.exe
  2⤵
  PID:10736
- C:\Windows\System\oacFTJr.exe
  C:\Windows\System\oacFTJr.exe
  2⤵
  PID:10788
- C:\Windows\System\CcfPUUu.exe
  C:\Windows\System\CcfPUUu.exe
  2⤵
  PID:10840
- C:\Windows\System\GJcYAAe.exe
  C:\Windows\System\GJcYAAe.exe
  2⤵
  PID:10964
- C:\Windows\System\LdWTmfm.exe
  C:\Windows\System\LdWTmfm.exe
  2⤵
  PID:11012
- C:\Windows\System\bjoNKVX.exe
  C:\Windows\System\bjoNKVX.exe
  2⤵
  PID:11140
- C:\Windows\System\jqWmYaH.exe
  C:\Windows\System\jqWmYaH.exe
  2⤵
  PID:11216
- C:\Windows\System\bBZIczU.exe
  C:\Windows\System\bBZIczU.exe
  2⤵
  PID:10260
- C:\Windows\System\wxtMSzN.exe
  C:\Windows\System\wxtMSzN.exe
  2⤵
  PID:10420
- C:\Windows\System\DJWuRBd.exe
  C:\Windows\System\DJWuRBd.exe
  2⤵
  PID:10660
- C:\Windows\System\zoraQFN.exe
  C:\Windows\System\zoraQFN.exe
  2⤵
  PID:10756
- C:\Windows\System\QdgLICq.exe
  C:\Windows\System\QdgLICq.exe
  2⤵
  PID:10940
- C:\Windows\System\JwwMJWC.exe
  C:\Windows\System\JwwMJWC.exe
  2⤵
  PID:10960
- C:\Windows\System\cTaSSIM.exe
  C:\Windows\System\cTaSSIM.exe
  2⤵
  PID:11036
- C:\Windows\System\HsTMKOI.exe
  C:\Windows\System\HsTMKOI.exe
  2⤵
  PID:9856
- C:\Windows\System\cwAARgL.exe
  C:\Windows\System\cwAARgL.exe
  2⤵
  PID:10364
- C:\Windows\System\rBSKxFX.exe
  C:\Windows\System\rBSKxFX.exe
  2⤵
  PID:10884
- C:\Windows\System\pzJLJxn.exe
  C:\Windows\System\pzJLJxn.exe
  2⤵
  PID:10800
- C:\Windows\System\RCUpBXq.exe
  C:\Windows\System\RCUpBXq.exe
  2⤵
  PID:11304
- C:\Windows\System\pnLcfNq.exe
  C:\Windows\System\pnLcfNq.exe
  2⤵
  PID:11348
- C:\Windows\System\bJyWWmV.exe
  C:\Windows\System\bJyWWmV.exe
  2⤵
  PID:11368
- C:\Windows\System\OJzyACJ.exe
  C:\Windows\System\OJzyACJ.exe
  2⤵
  PID:11388
- C:\Windows\System\XYEdbFW.exe
  C:\Windows\System\XYEdbFW.exe
  2⤵
  PID:11432
- C:\Windows\System\CIkWYAg.exe
  C:\Windows\System\CIkWYAg.exe
  2⤵
  PID:11476
- C:\Windows\System\ZuqwXFM.exe
  C:\Windows\System\ZuqwXFM.exe
  2⤵
  PID:11504
- C:\Windows\System\gSmZfgS.exe
  C:\Windows\System\gSmZfgS.exe
  2⤵
  PID:11528
- C:\Windows\System\DzoGPDk.exe
  C:\Windows\System\DzoGPDk.exe
  2⤵
  PID:11548
- C:\Windows\System\AkvqliK.exe
  C:\Windows\System\AkvqliK.exe
  2⤵
  PID:11576
- C:\Windows\System\tgPSDKY.exe
  C:\Windows\System\tgPSDKY.exe
  2⤵
  PID:11608
- C:\Windows\System\NCoGCHO.exe
  C:\Windows\System\NCoGCHO.exe
  2⤵
  PID:11640
- C:\Windows\System\caonrgT.exe
  C:\Windows\System\caonrgT.exe
  2⤵
  PID:11676
- C:\Windows\System\eVfanVb.exe
  C:\Windows\System\eVfanVb.exe
  2⤵
  PID:11704
- C:\Windows\System\HIkmErd.exe
  C:\Windows\System\HIkmErd.exe
  2⤵
  PID:11744
- C:\Windows\System\QElkscy.exe
  C:\Windows\System\QElkscy.exe
  2⤵
  PID:11772
- C:\Windows\System\OWTLhOY.exe
  C:\Windows\System\OWTLhOY.exe
  2⤵
  PID:11788
- C:\Windows\System\epDGbHK.exe
  C:\Windows\System\epDGbHK.exe
  2⤵
  PID:11828
- C:\Windows\System\srRWCCN.exe
  C:\Windows\System\srRWCCN.exe
  2⤵
  PID:11852
- C:\Windows\System\efzdliq.exe
  C:\Windows\System\efzdliq.exe
  2⤵
  PID:11876
- C:\Windows\System\ePiNJAa.exe
  C:\Windows\System\ePiNJAa.exe
  2⤵
  PID:11896
- C:\Windows\System\GnlNnXq.exe
  C:\Windows\System\GnlNnXq.exe
  2⤵
  PID:11924
- C:\Windows\System\UcsiPpA.exe
  C:\Windows\System\UcsiPpA.exe
  2⤵
  PID:11944
- C:\Windows\System\yYFPNCW.exe
  C:\Windows\System\yYFPNCW.exe
  2⤵
  PID:11968
- C:\Windows\System\XcMofhk.exe
  C:\Windows\System\XcMofhk.exe
  2⤵
  PID:11988
- C:\Windows\System\EFcAOri.exe
  C:\Windows\System\EFcAOri.exe
  2⤵
  PID:12012
- C:\Windows\System\ewpABAN.exe
  C:\Windows\System\ewpABAN.exe
  2⤵
  PID:12068
- C:\Windows\System\WLALkhP.exe
  C:\Windows\System\WLALkhP.exe
  2⤵
  PID:12088
- C:\Windows\System\EnuyiEQ.exe
  C:\Windows\System\EnuyiEQ.exe
  2⤵
  PID:12116
- C:\Windows\System\YHPZKmd.exe
  C:\Windows\System\YHPZKmd.exe
  2⤵
  PID:12148
- C:\Windows\System\OXkbMtt.exe
  C:\Windows\System\OXkbMtt.exe
  2⤵
  PID:12172
- C:\Windows\System\BOqGseb.exe
  C:\Windows\System\BOqGseb.exe
  2⤵
  PID:12196
- C:\Windows\System\IeAoGFt.exe
  C:\Windows\System\IeAoGFt.exe
  2⤵
  PID:12232
- C:\Windows\System\BABAlmW.exe
  C:\Windows\System\BABAlmW.exe
  2⤵
  PID:12272
- C:\Windows\System\vuofSmv.exe
  C:\Windows\System\vuofSmv.exe
  2⤵
  PID:10596
- C:\Windows\System\zTAkNqy.exe
  C:\Windows\System\zTAkNqy.exe
  2⤵
  PID:11240
- C:\Windows\System\upgMGFi.exe
  C:\Windows\System\upgMGFi.exe
  2⤵
  PID:11332
- C:\Windows\System\yiRtdVv.exe
  C:\Windows\System\yiRtdVv.exe
  2⤵
  PID:11412
- C:\Windows\System\MNAECtl.exe
  C:\Windows\System\MNAECtl.exe
  2⤵
  PID:11468
- C:\Windows\System\XNyICys.exe
  C:\Windows\System\XNyICys.exe
  2⤵
  PID:11592
- C:\Windows\System\ugOKCcl.exe
  C:\Windows\System\ugOKCcl.exe
  2⤵
  PID:11652
- C:\Windows\System\dnNSeDl.exe
  C:\Windows\System\dnNSeDl.exe
  2⤵
  PID:11720
- C:\Windows\System\MnDKHIu.exe
  C:\Windows\System\MnDKHIu.exe
  2⤵
  PID:11760
- C:\Windows\System\AhzhYAJ.exe
  C:\Windows\System\AhzhYAJ.exe
  2⤵
  PID:11884
- C:\Windows\System\UHdRrwm.exe
  C:\Windows\System\UHdRrwm.exe
  2⤵
  PID:11916
- C:\Windows\System\oTkFUPw.exe
  C:\Windows\System\oTkFUPw.exe
  2⤵
  PID:11936
- C:\Windows\System\nOyXjpH.exe
  C:\Windows\System\nOyXjpH.exe
  2⤵
  PID:12032
- C:\Windows\System\dNaHyRE.exe
  C:\Windows\System\dNaHyRE.exe
  2⤵
  PID:12096
- C:\Windows\System\PSgQeZI.exe
  C:\Windows\System\PSgQeZI.exe
  2⤵
  PID:12160
- C:\Windows\System\HbvqHmA.exe
  C:\Windows\System\HbvqHmA.exe
  2⤵
  PID:228
- C:\Windows\System\yYuduvO.exe
  C:\Windows\System\yYuduvO.exe
  2⤵
  PID:12216
- C:\Windows\System\krnSEjO.exe
  C:\Windows\System\krnSEjO.exe
  2⤵
  PID:11316
- C:\Windows\System\WHvwmEX.exe
  C:\Windows\System\WHvwmEX.exe
  2⤵
  PID:10640
- C:\Windows\System\xsigREx.exe
  C:\Windows\System\xsigREx.exe
  2⤵
  PID:11376
- C:\Windows\System\CKDhczv.exe
  C:\Windows\System\CKDhczv.exe
  2⤵
  PID:11500
- C:\Windows\System\xswhfTG.exe
  C:\Windows\System\xswhfTG.exe
  2⤵
  PID:11632
- C:\Windows\System\RWEOYVT.exe
  C:\Windows\System\RWEOYVT.exe
  2⤵
  PID:11696
- C:\Windows\System\MOsWZsU.exe
  C:\Windows\System\MOsWZsU.exe
  2⤵
  PID:11844
- C:\Windows\System\pPzrkAh.exe
  C:\Windows\System\pPzrkAh.exe
  2⤵
  PID:11980
- C:\Windows\System\wWBqDaw.exe
  C:\Windows\System\wWBqDaw.exe
  2⤵
  PID:12080
- C:\Windows\System\vXXlzUL.exe
  C:\Windows\System\vXXlzUL.exe
  2⤵
  PID:12356
- C:\Windows\System\PLmMZvk.exe
  C:\Windows\System\PLmMZvk.exe
  2⤵
  PID:12388
- C:\Windows\System\XHWTNbC.exe
  C:\Windows\System\XHWTNbC.exe
  2⤵
  PID:12408
- C:\Windows\System\fCdWlcT.exe
  C:\Windows\System\fCdWlcT.exe
  2⤵
  PID:12440
- C:\Windows\System\xmHCNqX.exe
  C:\Windows\System\xmHCNqX.exe
  2⤵
  PID:12460
- C:\Windows\System\xabQHqd.exe
  C:\Windows\System\xabQHqd.exe
  2⤵
  PID:12480
- C:\Windows\System\FeRPyHF.exe
  C:\Windows\System\FeRPyHF.exe
  2⤵
  PID:12544
- C:\Windows\System\TbHRcQi.exe
  C:\Windows\System\TbHRcQi.exe
  2⤵
  PID:12572
- C:\Windows\System\oBzAfaV.exe
  C:\Windows\System\oBzAfaV.exe
  2⤵
  PID:12596
- C:\Windows\System\GFJscut.exe
  C:\Windows\System\GFJscut.exe
  2⤵
  PID:12612
- C:\Windows\System\IqHJrft.exe
  C:\Windows\System\IqHJrft.exe
  2⤵
  PID:12644
- C:\Windows\System\sinKEVv.exe
  C:\Windows\System\sinKEVv.exe
  2⤵
  PID:12672
- C:\Windows\System\wSZTKxL.exe
  C:\Windows\System\wSZTKxL.exe
  2⤵
  PID:12696
- C:\Windows\System\DhqpNSw.exe
  C:\Windows\System\DhqpNSw.exe
  2⤵
  PID:12716
- C:\Windows\System\LBtDBUn.exe
  C:\Windows\System\LBtDBUn.exe
  2⤵
  PID:12768
- C:\Windows\System\vlOkBvI.exe
  C:\Windows\System\vlOkBvI.exe
  2⤵
  PID:12792
- C:\Windows\System\OXPyWur.exe
  C:\Windows\System\OXPyWur.exe
  2⤵
  PID:12828
- C:\Windows\System\CtrQhXj.exe
  C:\Windows\System\CtrQhXj.exe
  2⤵
  PID:12868
- C:\Windows\System\zMSRGur.exe
  C:\Windows\System\zMSRGur.exe
  2⤵
  PID:12888
- C:\Windows\System\puJqYkL.exe
  C:\Windows\System\puJqYkL.exe
  2⤵
  PID:12916
- C:\Windows\System\xwYMZEG.exe
  C:\Windows\System\xwYMZEG.exe
  2⤵
  PID:12944
- C:\Windows\System\kEycNSI.exe
  C:\Windows\System\kEycNSI.exe
  2⤵
  PID:12984
- C:\Windows\System\UUHQzhA.exe
  C:\Windows\System\UUHQzhA.exe
  2⤵
  PID:13004
- C:\Windows\System\dprpIvr.exe
  C:\Windows\System\dprpIvr.exe
  2⤵
  PID:13028
- C:\Windows\System\SWdHYeS.exe
  C:\Windows\System\SWdHYeS.exe
  2⤵
  PID:13048
- C:\Windows\System\mvvPPHF.exe
  C:\Windows\System\mvvPPHF.exe
  2⤵
  PID:13076
- C:\Windows\System\HxaUzTm.exe
  C:\Windows\System\HxaUzTm.exe
  2⤵
  PID:13104
- C:\Windows\System\KAgzvyB.exe
  C:\Windows\System\KAgzvyB.exe
  2⤵
  PID:13124
- C:\Windows\System\wgXXnnx.exe
  C:\Windows\System\wgXXnnx.exe
  2⤵
  PID:13176
- C:\Windows\System\TcIKQUz.exe
  C:\Windows\System\TcIKQUz.exe
  2⤵
  PID:13212
- C:\Windows\System\IBBNvBl.exe
  C:\Windows\System\IBBNvBl.exe
  2⤵
  PID:13232
- C:\Windows\System\wjXLfUj.exe
  C:\Windows\System\wjXLfUj.exe
  2⤵
  PID:13252
- C:\Windows\System\rAWxdcJ.exe
  C:\Windows\System\rAWxdcJ.exe
  2⤵
  PID:13268
- C:\Windows\System\UtbFQBS.exe
  C:\Windows\System\UtbFQBS.exe
  2⤵
  PID:13288
- C:\Windows\System\NTaGtCb.exe
  C:\Windows\System\NTaGtCb.exe
  2⤵
  PID:7028
- C:\Windows\System\DohpZOi.exe
  C:\Windows\System\DohpZOi.exe
  2⤵
  PID:12296
- C:\Windows\System\crvNwVW.exe
  C:\Windows\System\crvNwVW.exe
  2⤵
  PID:11296
- C:\Windows\System\fUtkLMV.exe
  C:\Windows\System\fUtkLMV.exe
  2⤵
  PID:11600
- C:\Windows\System\OCyovnz.exe
  C:\Windows\System\OCyovnz.exe
  2⤵
  PID:12404
- C:\Windows\System\kTSKdjC.exe
  C:\Windows\System\kTSKdjC.exe
  2⤵
  PID:12368
- C:\Windows\System\btBLLit.exe
  C:\Windows\System\btBLLit.exe
  2⤵
  PID:12456
- C:\Windows\System\sQzRQZt.exe
  C:\Windows\System\sQzRQZt.exe
  2⤵
  PID:12584
- C:\Windows\System\ddNlscW.exe
  C:\Windows\System\ddNlscW.exe
  2⤵
  PID:12608
- C:\Windows\System\hylWimL.exe
  C:\Windows\System\hylWimL.exe
  2⤵
  PID:12640
- C:\Windows\System\RdMVJVi.exe
  C:\Windows\System\RdMVJVi.exe
  2⤵
  PID:12724
- C:\Windows\System\zChMWOW.exe
  C:\Windows\System\zChMWOW.exe
  2⤵
  PID:12788
- C:\Windows\System\wtORdsC.exe
  C:\Windows\System\wtORdsC.exe
  2⤵
  PID:12900
- C:\Windows\System\kcNkllE.exe
  C:\Windows\System\kcNkllE.exe
  2⤵
  PID:12936
- C:\Windows\System\QpxOxAo.exe
  C:\Windows\System\QpxOxAo.exe
  2⤵
  PID:13000
- C:\Windows\System\EKzqTdc.exe
  C:\Windows\System\EKzqTdc.exe
  2⤵
  PID:13088
- C:\Windows\System\TkqIdCc.exe
  C:\Windows\System\TkqIdCc.exe
  2⤵
  PID:13160
- C:\Windows\System\KyqxDGg.exe
  C:\Windows\System\KyqxDGg.exe
  2⤵
  PID:13192
- C:\Windows\System\EQBLZMj.exe
  C:\Windows\System\EQBLZMj.exe
  2⤵
  PID:13264
- C:\Windows\System\edVlhNX.exe
  C:\Windows\System\edVlhNX.exe
  2⤵
  PID:1224
- C:\Windows\System\cTwSmob.exe
  C:\Windows\System\cTwSmob.exe
  2⤵
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fongfiae.opa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BKTSbxC.exe

Filesize
1.9MB

MD5
d29e5a0784893eb6636e409ab0ad860f

SHA1
29bf6a88e4aa06e5a358d855dfee3398692377d6

SHA256
e82ffffcaa9355c465913b599c27b8ab35926b10cda46b47b333a0c530314309

SHA512
7891cd552e8a87d99d12ecbbcef195839d470c67a194127d7c4a4d353c2822d9cfa1a171c88cb299839d2e9c4f47f7e1fd5c15ef1b153ee7f919bebe8c0a6b3f

Download Submit
C:\Windows\System\BLjkpgj.exe

Filesize
1.9MB

MD5
aac0f63850fbd4c4bdfd79f50595e177

SHA1
cae66043da7401dacc18afaadbc472129237c0b3

SHA256
f976547ab7b75a73a4d5c1f3e812e588556c202b8d74e1ab7488e1d949783630

SHA512
b197e72af19b1019c54911e6548c39f55c7b6a8d3843f8c6223f53a5a5760e9654860805d51d697acd823726fb6ad60dd96f0ecd8b6d1cccadd3f0c50ff0a1c5

Download Submit
C:\Windows\System\DdIBLuI.exe

Filesize
1.9MB

MD5
cfa0d6db8fcf7a086e65ffb521e3e3d1

SHA1
edbc6e6354b36141bdf7612df4271f7cc4601301

SHA256
527eea9a77a97de9e76a0a46e0e95a5c83a5e78f96b3404a478e0a542124edc6

SHA512
8e0635c60f5eded44d3a98cb49a5efd4ec84f5bc1378bebad277c9bf7ee16f3ced873528ead6007caafc7161ed6d4404d5915c69ca97514ab1a1cd7eedecd190

Download Submit
C:\Windows\System\DnwVNRw.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\FRLvPWF.exe

Filesize
1.9MB

MD5
d965a2c4b25e3ea27a0f1df5f395119e

SHA1
93fa0afc508bcda037c1db2e4ddb2ef560677aa0

SHA256
997b2ab5f64871a13a96273e7e9a8c7a2a541e2f27b0b6cb4adba7aa382ec842

SHA512
d6e9d34ace5006ebacd83828685a2edb63bb8e922c4093f5bec8bfd10e0ad2035a001ab278411afc91ca20a4c750b0c023958ba56d10036201bc6ad985a226cf

Download Submit
C:\Windows\System\HlAZIBO.exe

Filesize
1.9MB

MD5
05b0041e93836720dc2a08ff88fe2ab6

SHA1
3aee0b60a7a66d5f9130f4429292df5187c3ec8a

SHA256
96a84809d012b3eb1163c3cde95daf1d58f47290d2a32f8c4edbbc2ad521b3c9

SHA512
702ec67fb4497573950bd6fd76db0afacf6ceb1f6b344553c823b974ad7948003c54d5a1e24b56adf5db482b386e57cb60011a93ae9708d32edc01bc03e3dc6e

Download Submit
C:\Windows\System\KKoAfPw.exe

Filesize
1.9MB

MD5
e3d9be6b548414b43b74a684ae67a31e

SHA1
69503457209fc4095bf8d3dcc3e169f61df22480

SHA256
2e447afee5f940124582733a61c8d9e954b6d716e3a024e8f444a2a7df4d6cc0

SHA512
d4058db41cfeb379a652bb1b88c5db31d1ddad1ea5af7ee0d0c260373615c683030c79b9cda773d9db329719566b2ccb2c9821e20699d42d6f912c6c450e297f

Download Submit
C:\Windows\System\PHzWtGZ.exe

Filesize
1.9MB

MD5
35557b11ce9bcb4cb33896bdc551a951

SHA1
79bad4b0c6df24df532c845507edad704720ce9b

SHA256
2787ffab174f7c98566b18efc88806626c5743c24f14c39b70506f8a093424e6

SHA512
5702257a42598ea5b45ba4049def24cdf54efb60f489ccecf9dc962091ae92f9ec94ecb3ec0e9352e045156bfecd92a8bc68f68d23e8834ebb68a19840ddbd43

Download Submit
C:\Windows\System\QvBHgcJ.exe

Filesize
1.9MB

MD5
fb1c8ef4ad4533885eff71f2bc4a4a06

SHA1
58128d4179ade3ddba3f8304ac4738ac5d372884

SHA256
75ee4dcd82510da6f7db30c92da06377077f029bca9231db48e5e336147e051a

SHA512
003a0d38b363d48167662a355372a9651c07a3b9cc41011f60b5aef15a66225d8c997974c968c42a2fa95ef12c46d5c7f034e2540c415ff5590b184624382819

Download Submit
C:\Windows\System\Tiexlvh.exe

Filesize
1.9MB

MD5
3d64804946b22952e8bfa4a87e9fe769

SHA1
e558ff0ae5038ce84c1aaf31c12d403398e13765

SHA256
6c78d8892f47f620c839a8e103db81e18618bf397825b7932f08ba3743c5f6e9

SHA512
4872d55973aaa0dc8c627cc3200051a04aec936d9c8891f1eda92a41e82c941a26266dff0c83a0cc07005506ac2e98d97a930ffc6bf2790a9a76698b582b0a4c

Download Submit
C:\Windows\System\UtGyPQj.exe

Filesize
1.9MB

MD5
43874d5fa637feadba6505adfd01ab6b

SHA1
75ded76205d1115cc1f5cde3b2bf2bd6ca78a031

SHA256
54fee36b5a24c0de60511c1be00fae018387d339eb0402387869e0cc0aaa84f9

SHA512
4c9dc592cd8bfeff9b64d80c3109de728e1506f0d97101dc77b1b0e2d85ba335d08ebf1e029026a5d9dec7655eb69158199369dc7556b0c0909b9ef9d4a943b1

Download Submit
C:\Windows\System\VCFKiPH.exe

Filesize
1.9MB

MD5
097272d6ba5368d2a40f9e0c6f67277c

SHA1
e6eff8c8bb5201ddfbdb5370161fee2d794820ee

SHA256
9c1d3a2513ca43697851880e517d28e20d73fa3a2d7c8f326752c9463f2e267d

SHA512
51236b628fa35b83aea6463807946060593d0b4ffd83ead42b4f10c1ba3eb844cc7f282ff8f6d65eef1540631da9c21e93ce644c693c12400203601198ff8730

Download Submit
C:\Windows\System\VdTLFnl.exe

Filesize
1.9MB

MD5
7f4f39abe6ecd5c65e39fa42dcd2e527

SHA1
9f21cc0c1f17f0d9a329d3f5dd1e9778fb1a8151

SHA256
3e85286a821e0165875f4d71e67b2b89705ecc97ae3289cba0b2e5942b19551d

SHA512
669f9990c45bca700d1701e9e7a55028e74280bb61497f5384e8c4377f471a0159fd5726779e94f517654ba515fb072279b85854124c12691441ae7750141500

Download Submit
C:\Windows\System\WdmYsCJ.exe

Filesize
1.9MB

MD5
fb68ebde605ae299b441261f4c2e28d9

SHA1
0c786f724f58c6951bd2359467f4065e0eedadb4

SHA256
5f57bbfd71aa62aed2c0ff33d8f0c030f15b603452def5e25dc5e4273f690663

SHA512
a0cf899618ea69179a57fde0d02d69e073838613aa54e56b5464dde1439c903b858f21934897e11662ff749f212867594f542a29062bef28457e55124951b1ae

Download Submit
C:\Windows\System\WuwiegC.exe

Filesize
1.9MB

MD5
5a8fa59a9ea9267bb0e6002b76d0d2d3

SHA1
597fafe965f32bb3f07ade1507e1c7dc1c207977

SHA256
cc49810c57a4e4956f7aec753d2c4d9d7ad212509e712821085f6bcb5f1e8960

SHA512
fc3dbab68118aae43d325ff174b42e2ee6a64136571c746dfac175388f202d5de7cfd79bdc3f5a03b4a9f585a83b778d4217b1bed81eff317fdf9896384954a8

Download Submit
C:\Windows\System\XnhbrWW.exe

Filesize
1.9MB

MD5
6d198b4c999d6aa55dd441ed1d43707c

SHA1
cfe55f6a9f9e1b5fe8d535bd662b6981724f627e

SHA256
abca0c2be4990434fdc56624c91e928ec5524f2423fd11a087738a38e8005671

SHA512
d9f0fc9ac2786c27454d3943e99f0794c5256c9a907f3c6478354f4b7801dce95b70f34a08e139a433048fdb1b15b1594c197f61da744530ab1633fda8322fab

Download Submit
C:\Windows\System\YyNOLXU.exe

Filesize
1.9MB

MD5
97da3dd3f4978db928a4981a9890bf7e

SHA1
733bdf003d10876b8bede264b0e18289381c8039

SHA256
907cb0e31aba574a46500b0582cdc36c04b9fcc0dc9b2a0497be2c8f29165fd4

SHA512
1c23f299804aa73ba48f6c0ffbc2faaea5f515990da86213ae3cd534c35ae8238da04688f3ef136923ddaa64d0c0c5dfb0a83ca496a7dfc8d95c9718b15a1364

Download Submit
C:\Windows\System\aXVduOR.exe

Filesize
1.9MB

MD5
09788cd8e8088877e1cb00b0adfa6ba1

SHA1
42a00107fe3e2f0b86043f3cdfa680888b6d0069

SHA256
33d5650ff962c8584b05a0ef984d25c7d5e534465254f3d1eab9ebf342fc8c59

SHA512
a78107c5995006e5bc9cf52b2af1b0dc9633cb9787a8f02d69703a84d72ead3c95232acd50f208888a06be64d591928eff53ca9e6a04d33c9eaa955352ab0a2e

Download Submit
C:\Windows\System\ajazpdD.exe

Filesize
1.9MB

MD5
30c24a2b7536a5e9ae774898ab2fcfc1

SHA1
291315beb25c1023ef439b4e895d1d4804b9d940

SHA256
54385c1c1d07e781f00c85bc489c62454074392e6b49cc4c77bd08120523a537

SHA512
8ead7e57f0fd2a2b453a7b3d329314f965d7c863a5fa8fba982e97e0d10ae7a2d5de877d3fc8247d398fac7665d050413147b1919f3e652f6c9579d0b0235659

Download Submit
C:\Windows\System\anMJFkE.exe

Filesize
1.9MB

MD5
9d019879d254df02cdac8f940b954033

SHA1
b13b1141de94ef33ed859e4c3909ea71704770ee

SHA256
5af398a9a0e561e68297ee364d80fb600bc2c67a86deee9ac1cf80ab8a584802

SHA512
39a70a38e455119d5a3cebe4ee32dd71ff181aeed550aeba2077237782e6fe6eaf40e0e19914e9061f6709eeac10b8a5f992fd9114faf711c6de31e1337914dd

Download Submit
C:\Windows\System\fulODJi.exe

Filesize
1.9MB

MD5
5c2adc5f08fea5929d974f263dcac9ad

SHA1
8882dc8522e014efe26594c605d14d4b8fd6dfd2

SHA256
4aeb05826c6728b0b60b9e2806f0767a2af211285cc1453ca5f01dd37c050fe8

SHA512
76add0ad9ce24e11c1576293c4a647cc2f99875fc2f936959089fc78aa3297c0ff826827a5ed9772bb0baa4b89bc74c7d31f759fd17a1c821337dca66a026c8f

Download Submit
C:\Windows\System\iLtWcAs.exe

Filesize
1.9MB

MD5
0a2fd21c61b1c197275644fe6441f04e

SHA1
0d862ebd9901724c7c7e327de47e346f41ab0720

SHA256
7ed66e696f643d15d13355bc5e0e8c7c130b37eda2f145ee64544705661ba5e2

SHA512
b20e0d2f64e9354e92ff861f2a21ae8480fb8af43974c5cf7643e72f017b8b097e5eb6d233a8285bced944a7497ada96a4a16973d384d11226f2ffa837a4f3bd

Download Submit
C:\Windows\System\ielurPd.exe

Filesize
1.9MB

MD5
a508a66a66b676b1890e62f3eaf0c160

SHA1
7824a86093e176b5f7037dacb08ca7bf642bd99c

SHA256
efb2d0fb302e211c6151b080148be3e131fea42803a3629caae59d28ace005ea

SHA512
476cd2891036e3a6db26d28f780809dbd5828dd1309d933e5cc2d19902672481e5e4aa8f99d4f3f950be32394491fc6170e44c15835b953438a41dd3e56c27a9

Download Submit
C:\Windows\System\ixKnPdR.exe

Filesize
1.9MB

MD5
d729406a3313d9d6cb3568d84ced46f0

SHA1
041e941ef74998ef1dc86c2dda1e801f69519521

SHA256
59b54862448f7c5a65758be78d2f7696391a0cfe426890ec233fe46aef705996

SHA512
00fe89d15129d67b4ad2bc600867182acc3c9efb471932b540cf49de8195b05d6742a2e73f0326933e4538982c900e2389e17b75d9ad98a218a31a07dd06fda7

Download Submit
C:\Windows\System\iyrGRee.exe

Filesize
1.9MB

MD5
36ac7729dd47543ddbcf92181ea4f2e2

SHA1
4904075207d62c41fb90cae5eb1dc1031c5d1634

SHA256
76f92e2f70d5cf564bbf79c0e084dd045cd5cc9f80f6a0ff0153da5c795465c3

SHA512
71bd5761caed9fee25968cc4b8964fefcd37d80e8bdb892e191847ab13114da49531617b7e4c7f26d533bc355b7f6210a89bd871dfb0ebfa8858f5034320d33f

Download Submit
C:\Windows\System\jEJXgNg.exe

Filesize
1.9MB

MD5
f5381282e6fb390b46a194ef1171562a

SHA1
9fd420d3891296b08df688ec70528fb8c2f5be77

SHA256
09e4cd3b61847f562e84befa3652f8d7f794f5ca141d3b7b73fc70ccb3215fab

SHA512
987f00f28bc66c342e2afbe58d2b2524176493234f7310d8a3abde8909077c564ad10d94ba7b38bc0ab8114d9e6d4557a610a009a8b9735bbff363c8c06821ac

Download Submit
C:\Windows\System\lSReJmJ.exe

Filesize
1.9MB

MD5
27668f36851089411208a74c99a49c56

SHA1
55cb46c9056cf03b23b2a1f2e4f4ba8461f8b800

SHA256
4ecefe42db4d19827b82f008eeae7e35b68f3f53d9bb80a9ca92e923d4c563af

SHA512
155a7ad9751658975d0420b8268bb9acb07a671ce2b0d75aef74991626f6118fc8cc0b067115e84c4a21bc09e2e76f9aa5866986ec87ace4dcfa146a7be0ea95

Download Submit
C:\Windows\System\nLQXojG.exe

Filesize
1.9MB

MD5
282bcd521fd97404217097f747b367f1

SHA1
f3e4935ca9bd2322fb42849c60e7d5b0c24d870e

SHA256
ca8a25688707914392f94c5f12385abfe703782c3cfc519e69a2c21e899f5db5

SHA512
67571dc52fd94551507aa447244fdca57cb73741737390ad60b0d2f0ca5cc9d31cfbb678af50d88068a0c01ea5e260e6bc48080bacd45d0740df67aadb5c9b5b

Download Submit
C:\Windows\System\nliYJCC.exe

Filesize
1.9MB

MD5
e889295a997396842fca305eda1fdfcb

SHA1
5d19aec431e9e88d9315af1ad6831ec5d6b8928d

SHA256
905e707937955a55037802a88b0b197bba897a040ee4eb1dc4f09694064821e8

SHA512
4f4579c6d306fef81d36be113f5573fe866d81997a53e5e9f3c66513615f8dee95d3b8eff76709fcf6d90809b17f853538bf64fb94b0fe3a4bb15a8e9854731a

Download Submit
C:\Windows\System\nmbPpuW.exe

Filesize
1.9MB

MD5
8ad42b9c0da2a3680666fe9028d903cc

SHA1
f225ca6fef0cfd08ad1bc807db4e44e492370732

SHA256
dfeab0bba94b71baa75de33283158f1488141f92fb508d93787c1867b324530e

SHA512
d171ba388ec90e21f356fc42d8731e9f7e8850709114bba610288ca3a7839cb9cdf179601f688f698cdbdc8ca872e7892532204726ae91976c2b46b2e67acd07

Download Submit
C:\Windows\System\onevXfS.exe

Filesize
1.9MB

MD5
ce3a3ea0eb6c31ae597021bcd3c293d4

SHA1
5505069cac88fc73bf4f80b6ba7404c5fbb932cb

SHA256
fa247b79ec8ff98ea36fb19c7364a28df50a4ac55b519412370b2202223c6b5b

SHA512
55b4cb8feee49b92f072277319642e2824a5e73cb2046779cf0e66c9337e7a98482cc2faa6c55c79e94180a5b356f0588499b802eca154441dc32f0af233d834

Download Submit
C:\Windows\System\sFnbeRF.exe

Filesize
1.9MB

MD5
827bad914c0bba4ed155ffd0a43ed215

SHA1
f1871eea5eef12e069f66a588f62a3bd65e149a6

SHA256
338457b787a0c9dd3e9191da28f5ebb047b848be557f222d2144b3439aa7d060

SHA512
942eb1b88c1dc1313cb39b154705533f9a492da0c70649466fa505c53dcbd94d2ededa05379a8d0de01e7de59330f8cf92c34041f76faf2d6fd3e4bf6462d708

Download Submit
C:\Windows\System\wsGDcbN.exe

Filesize
1.9MB

MD5
44e1f7810c2ddf7eaae7612c75a4cd21

SHA1
291761533e2e94a650f164b3f7e74f2583051b5f

SHA256
fcb2387fb41ede98fece807ff6898e9f439466eca9883ab8e318b7f5593c5558

SHA512
5b29be357d64109ab5095dd51377bddea36926581160060ea2bb6e3234f15fcc725f232a2c718e6a57fe8b70283a457da6b2942e6028afcc4d29b49ca172fc50

Download Submit
C:\Windows\System\xSubBrr.exe

Filesize
1.9MB

MD5
b0a6063df5dcb15339e55f0b4818357b

SHA1
ecf26bd3cdac1d6adffed5f9b0b5596c7eb43a8a

SHA256
05e41216196e595028ab0d49cd850883661eedbf3b90f62e6a60cb80911342da

SHA512
0f2bc9e54a308487e35681cd9bdba83db6f780c5a6c78dbf91eeca4816a54b4a1b5bebbb9aad1b8a40c0854852da9ce2bb7f2a54bdc29c16130469b2f62345ae

Download Submit
memory/368-475-0x00007FF646390000-0x00007FF646782000-memory.dmp

Filesize
3.9MB

Download
memory/368-2452-0x00007FF646390000-0x00007FF646782000-memory.dmp

Filesize
3.9MB

Download
memory/564-0-0x00007FF600B70000-0x00007FF600F62000-memory.dmp

Filesize
3.9MB

Download
memory/564-1-0x0000022ED9460000-0x0000022ED9470000-memory.dmp

Filesize
64KB

Download
memory/1220-524-0x00007FF762320000-0x00007FF762712000-memory.dmp

Filesize
3.9MB

Download
memory/1220-2460-0x00007FF762320000-0x00007FF762712000-memory.dmp

Filesize
3.9MB

Download
memory/1268-2448-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp

Filesize
3.9MB

Download
memory/1268-474-0x00007FF6ADFA0000-0x00007FF6AE392000-memory.dmp

Filesize
3.9MB

Download
memory/1404-54-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1404-2428-0x00007FF75EB50000-0x00007FF75EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1576-495-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp

Filesize
3.9MB

Download
memory/1576-2472-0x00007FF6B8F40000-0x00007FF6B9332000-memory.dmp

Filesize
3.9MB

Download
memory/1596-70-0x000002B579480000-0x000002B5794A2000-memory.dmp

Filesize
136KB

Download
memory/1596-50-0x000002B5794E0000-0x000002B5794F0000-memory.dmp

Filesize
64KB

Download
memory/1596-48-0x00007FFF98A50000-0x00007FFF99511000-memory.dmp

Filesize
10.8MB

Download
memory/1596-1863-0x00007FFF98A50000-0x00007FFF99511000-memory.dmp

Filesize
10.8MB

Download
memory/1676-2434-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp

Filesize
3.9MB

Download
memory/1676-469-0x00007FF6E5ED0000-0x00007FF6E62C2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-2465-0x00007FF708090000-0x00007FF708482000-memory.dmp

Filesize
3.9MB

Download
memory/2268-506-0x00007FF708090000-0x00007FF708482000-memory.dmp

Filesize
3.9MB

Download
memory/2972-2450-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp

Filesize
3.9MB

Download
memory/2972-539-0x00007FF65B3A0000-0x00007FF65B792000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2439-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp

Filesize
3.9MB

Download
memory/3068-473-0x00007FF7E9190000-0x00007FF7E9582000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2446-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-470-0x00007FF6E0BF0000-0x00007FF6E0FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3328-2454-0x00007FF7994A0000-0x00007FF799892000-memory.dmp

Filesize
3.9MB

Download
memory/3328-476-0x00007FF7994A0000-0x00007FF799892000-memory.dmp

Filesize
3.9MB

Download
memory/3424-488-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp

Filesize
3.9MB

Download
memory/3424-2473-0x00007FF6BAA10000-0x00007FF6BAE02000-memory.dmp

Filesize
3.9MB

Download
memory/3512-529-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp

Filesize
3.9MB

Download
memory/3512-2432-0x00007FF72AB60000-0x00007FF72AF52000-memory.dmp

Filesize
3.9MB

Download
memory/3560-472-0x00007FF701C30000-0x00007FF702022000-memory.dmp

Filesize
3.9MB

Download
memory/3560-2444-0x00007FF701C30000-0x00007FF702022000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2462-0x00007FF723D50000-0x00007FF724142000-memory.dmp

Filesize
3.9MB

Download
memory/3564-521-0x00007FF723D50000-0x00007FF724142000-memory.dmp

Filesize
3.9MB

Download
memory/3664-2436-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-67-0x00007FF6320B0000-0x00007FF6324A2000-memory.dmp

Filesize
3.9MB

Download
memory/3896-471-0x00007FF663320000-0x00007FF663712000-memory.dmp

Filesize
3.9MB

Download
memory/3896-2443-0x00007FF663320000-0x00007FF663712000-memory.dmp

Filesize
3.9MB

Download
memory/4048-2441-0x00007FF773A30000-0x00007FF773E22000-memory.dmp

Filesize
3.9MB

Download
memory/4048-533-0x00007FF773A30000-0x00007FF773E22000-memory.dmp

Filesize
3.9MB

Download
memory/4300-477-0x00007FF761C70000-0x00007FF762062000-memory.dmp

Filesize
3.9MB

Download
memory/4300-2470-0x00007FF761C70000-0x00007FF762062000-memory.dmp

Filesize
3.9MB

Download
memory/4516-478-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2469-0x00007FF63DC30000-0x00007FF63E022000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2419-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2430-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-14-0x00007FF7525D0000-0x00007FF7529C2000-memory.dmp

Filesize
3.9MB

Download